# Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
###### Abstract  
The rapid adoption of mobile banking applications has raised significant concerns about their security vulnerabilities. This study presents a comparative vulnerability analysis of mobile banking applications from Thai and non-Thai banks, utilising the OWASP Mobile Top 10 framework. Nine mobile banking applications (five Thai and four non-Thai) were assessed using three vulnerability detection tools: AndroBugs, MobSF, and QARK. The results showed that both Thai and non-Thai mobile banking applications had vulnerabilities across multiple OWASP Mobile Top 10 categories, with reverse engineering, code tampering, and insufficient cryptography being the most common. Statistical analysis revealed that Thai banking applications exhibited significantly more vulnerabilities compared to non-Thai banking applications. In the context of vulnerability detection tools, AndroBugs and QARK proved more effective in detecting vulnerabilities compared to MobSF. Additionally, the study highlights critical security challenges in mobile banking applications, particularly for Thai banks, and emphasises the need for enhanced security measures. The findings also show the importance of using multiple assessment tools for comprehensive security evaluation and suggest potential areas for improvement in mobile banking applications.  
mobile banking applications; vulnerability analysis; OWASP Mobile Top 10; Thai banks Article]CityBresecurity and Privacy  
[PERSON]; [PERSON]; [PERSON]; [PERSON] [PERSON] Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications  
1][PERSON]; [PERSON]; [PERSON] [PERSON]; [PERSON] Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications  
1][PERSON]; [PERSON]; [PERSON] [PERSON] Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications  
1][PERSON].  
Security Project, has compiled a list of the most common vulnerabilities found in mobile applications. Although the details of the vulnerabilities are provided in the subsequent section, the OWASP Mobile Top 10 vulnerabilities [6] include such issues as insecure authentication and authorisation, insecure communication, insecure data storage, and insufficient use of cryptography. While many researchers and developers analyse mobile application security using different approaches from the OWASP's list of common vulnerabilities, they only cover some of the security concerns, not the whole list of OWASP [7].  
For this reason, it is critical to conduct thorough vulnerability assessments of these mobile banking applications to identify and mitigate any potential security threats based on the list of OWASP Top 10 most common vulnerabilities in mobile applications. In contrast to prior studies [7, 8, 9], we aim to assess the vulnerability of Android mobile banking applications in Thailand with the highest number of users using AndroBugs, MobSF, and QARK, focusing on the OWASP Mobile Top 10. In addition, we analysed the security of four other mobile banking applications in Asian countries and compared the security level with the Thai applications. By evaluating these applications for common security weaknesses, we can gain valuable insights into the overall security posture of mobile banking applications in Thailand.