# Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
## 4 Results and Discussion
### Effectiveness of Vulnerability Assessment Tools  
Our study employed three distinct vulnerability assessment tools, namely AndroBugs, MobSF, and QARK. The results indicate varying levels of effectiveness among these tools. AndroBugs and QARK demonstrated similar performance, detecting 66 and 64 vulnerabilities, respectively, across all applications. In contrast, MobSF detected notably fewer vulnerabilities (39 in total). Table 7 presents a comparison of the effectiveness of the three vulnerability assessment tools used in this study. The effectiveness is measured by the mean number of vulnerabilities each tool detected across all analysed mobile banking applications. The key findings from Table 7 can be explained as follows. AndroBugs detected, on average, 7.33 vulnerabilities per application (S.D. = 3.20). This tool showed the highest mean detection rate among the three tools evaluated. QARK demonstrated similar performance to AndroBugs, identifying an average of 7.11 vulnerabilities per application (S.D. = 3.06). The closeness of these mean values suggests that AndroBugs and QARK have comparable effectiveness in detecting vulnerabilities in mobile banking applications. Finally, MobSF detected an average of 4.33 vulnerabilities per application (S.D. = 2.65), which is notably lower than both AndroBugs and QARK. This suggests that MobSF could be less effective in identifying vulnerabilities compared to the other two tools. In addition, the standard deviations (S.D.) provide insight into the consistency of each tool's performance across different applications. AndroBugs shows the highest variability (S.D. = 3.20), followed closely by QARK (S.D. = 3.06), while MobSF demonstrates the least variability (S.D. = 2.65). This suggests that while MobSF detects fewer vulnerabilities on average, its performance appears to be more consistent across different applications. It is worth noting that each tool showed strengths in detecting specific types of vulnerabilities. For example, QARK consistently detected M1 (improper platform usage) vulnerabilities across all banks, while AndroBugs appeared more effective in identifying M2 (insecure data storage) issues. MobSF, despite detecting fewer vulnerabilities overall, was particularly effective in identifying M8 (code tampering) and M9 (reverse engineering) vulnerabilities. These findings emphasise the importance of using multiple assessment tools to gain a comprehensive view of an application's security posture, as each tool may have its own strengths and limitations. This observation is also aligned with that of [PERSON] et al. [7] and [PERSON] et al. [16], who recognised that to achieve comprehensive vulnerability assessment, multiple tools would be required. The security vulnerabilities identified in this study also have several important implications for mobile banking customers. First of all, the existence of vulnerabilities, such as reverse engineering and insufficient cryptography, suggests that customer data and financial information could be at risk. Customers using mobile banking applications with these vulnerabilities could potentially be exposed to data breaches, unauthorised access, and even financial fraud. Secondly, the difference in the number of vulnerabilities found in Thai and non-Thai mobile banking applications could impact customer trust and confidence. Customers may become hesitant to use banking applications if they believe them to be insecure. This leads to the third implication, where the awareness of security issues could influence how customers use mobile banking applications. In other words, they may limit \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{**Tool**} & **Raw** & **Mean Vulnerabilities** & \multirow{2}{*}{**S.D.**} \\  & **Vulnerability Counts** & **Detected per Application** & \\ \hline AndroBugs & 66 & 7.33 & 3.20 \\ QARK & 64 & 7.11 & 3.06 \\ MobSF & 39 & 4.33 & 2.65 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Tool Effectiveness Comparison.