# Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
## 5 Conclusions  
This study conducted a comprehensive vulnerability analysis of five Thai mobile banking Android applications and four international mobile banking applications. The analysis was performed using three vulnerability assessment tools, including AndroBugs, MobSF, and QARK, to identify vulnerabilities according to the OWASP Mobile Top 10 framework.  
The results of the study revealed a high occurrence of certain vulnerabilities across all the examined applications, particularly the reverse engineering, code tampering, and insufficient cryptography vulnerabilities. The comparison between Thai and non-Thai banking applications demonstrated that Thai banking applications had a higher number of vulnerabilities across all vulnerability categories. On average, Thai banks exhibited 22.80 vulnerabilities per application, while non-Thai banks showed 14.25 vulnerabilities, a statistically significant difference of \(p=0.041\).  
Furthermore, the comparison of the vulnerability assessment tools revealed that AndroBugs was the most effective in identifying vulnerabilities, followed by QARK and MobSF. This highlights the importance of using a multi-tool approach to conduct a thorough vulnerability analysis and ensure that a wide range of security issues are detected.  
Overall, these findings emphasise the urgent need for enhanced security measures in mobile banking applications, particularly among Thai banks. The high number of detected vulnerabilities related to reverse engineering, code tampering, and insufficient cryptography suggests that these areas should be prioritised in security improvement efforts. Moreover, the difference between Thai and non-Thai banking applications indicates a potential need for stricter regulations or improved security practices in the Thai banking sector.  
It is important to note that this study was limited to a specific set of banks and assessment tools. The sample size, while providing valuable insights, may not be representative of all mobile banking applications globally, including those from Europe and the U.S. Additionally, the rapid evolution of both mobile technologies and cyber threats means that the security landscape is continually changing. Therefore, future research could include a larger and more diverse sample of banks from various countries. The main reasons for the identified vulnerabilities, such as coding practices, development processes, and security awareness among mobile banking application developers, could also be explored and investigated. Finally, the correlation between the presence of these vulnerabilities and actual security breaches or financial losses could be examined.  
Conceptualisation, C.T. and S.B.; methodology, C.T. and S.B.; validation, S.B.; formal analysis, S.B.; experiments, S.T., J.R. and K.D.; writing--original draft preparation, S.B.; writing--review and editing, C.T. and S.B.; visualisation, S.B.; supervision, C.T. and S.B. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
The original contributions presented in the study are included in the article; further inquiries can be directed to the corresponding author.  
The authors declare no conflicts of interest.