# Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
## 2 Background and Related Work
### Mobile Application Vulnerability Analysis  
In recent years, security threats on mobile platforms, particularly Android, have escalated, presenting a significant challenge. Not only has the frequency of attacks increased, but their severity has also intensified. As a result, mobile application users are at risk of losing sensitive data, and in some cases, they may even lose access to their smartphones entirely. This leads to a need for vulnerability analysis of mobile applications. Vulnerability analysis in the context of cybersecurity can be defined as a test process used to identify and detect security-relevant issues that can create moderate or severe weaknesses in a system. From the attacker's perspective, if weaknesses or vulnerabilities of a system are found, it is possible to exploit them so that damage to the system can occur. One method of vulnerability analysis is known as static application security testing (SAST) or static analysis [10], which is a method for automatically testing the security of the application without having to execute the code. On the fundamental level, this method ensures that any security issues in the application are detected. The other method of vulnerability analysis is dynamic application security testing (DAST) or dynamic analysis [10], which usually involves tracing the execution of the application to understand exactly how it operates. This approach can also involve the analysis of memory and how the application uses or accesses the memory of the system. In this research, the static analysis method was adopted to maintain consistency with other existing research [7, 8]. The SAST process consists of five key steps. Initially, the information gathering phase involves analysing the application to identify its language, framework, and core functionalities. Subsequently, in the preparation step, any required reverse engineering is conducted to acquire the application's source code for further analysis. The third stage entails scanning for vulnerabilities, during which an automated code scan is executed. Following this, the fourth step involves identifying security flaws and exploitable vulnerabilities within the code. Finally, the process finishes with the generation of a detailed report highlighting critical vulnerabilities detected. Static and dynamic application security testing, as already mentioned, are fundamental components in the evaluation of vulnerabilities in mobile applications. Nevertheless, researchers have created specialised tools designed to suit the unique characteristics of mobile platforms. In this context, the discussion revolves around three vulnerability detection tools--AndroBugs, MobSF, and QARK--commonly utilised for the analysis of vulnerabilities in mobile applications. AndroBugs is a Python-based open-source SAST framework designed for Android applications. It operates on Android Package Kit (APK) files and does not require root access on the device. This tool features a modular design that enables researchers to enhance its capabilities by incorporating custom vulnerability vectors. The primary advantage of AndroBugs lies in its efficiency. By utilising predefined vulnerability patterns, it can quickly examine applications, making it well-suited for large-scale assessments. Studies conducted by [11, 12, 13, 14] utilised AndroBugs to examine a selection of popular Android applications, successfully identifying vulnerabilities such as insecure data storage and inadequate cryptography. The research highlights AndroBugs' efficacy as an initial screening tool for identifying potential security flaws in mobile applications. The Mobile Security Framework (MobSF), one of the most popular vulnerability scanners, is an open-source framework developed for conducting thorough security assessments of mobile applications. It features a modular design that integrates various static and dynamic analysis tools to identify vulnerabilities such as insecure data storage and weak cryptography through source code analysis.