# Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
## 4 Results and Discussion
### Comparison between Thai and Non-Thai Banks  
A comparative analysis between Thai and non-Thai banks revealed a notable inconsistency in security measures. On average, Thai banks exhibited a higher number of vulnerabilities across all categories compared to their non-Thai counterparts. This difference was particularly pronounced in categories such as M9 (reverse engineering), M10 (extraneous functionality), and M5 (insufficient cryptography). Among Thai banks, Bank A and Bank C showed the highest number of vulnerabilities (25 out of 30 possible detections), while Bank E demonstrated the best security posture with 18 out of 30 possible vulnerabilities detected. For non-Thai banks, the Indian Bank exhibited the highest number of vulnerabilities (20 out of 30 possible detections), whereas the Chinese Bank showed remarkably fewer vulnerabilities (just 5 out of 30 possible vulnerabilities). Table 5 presents a comparative analysis of the overall security posture between Thai and non-Thai banks, using the mean total vulnerabilities as the key metric. This value represents the average number of vulnerabilities detected across all OWASP Mobile Top 10 categories and all three assessment tools (AndroBug, MobSF, and QARK) for each group of banks. The results show a notable difference in the security posture between Thai and non-Thai banking applications, which can be explained as follows. The mean total number of \begin{table}
\begin{tabular}{c c c} \hline \hline
**Metric** & **Thai Banks** & **Non-Thai Banks** & **t-Value** & **\(p\)-Value** \\ \hline Mean Total & 22.80 & 14.25 & 2.35 & 0.041 \\ Vulnerabilities & (S.D. = 3.42) & (S.D. = 10.21) & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison between Thai and Non-Thai Banks. \begin{table}
\begin{tabular}{c  
vulnerabilities for Thai banks is 22.80 (S.D. = 3.42). This indicates that, on average, between 22 and 23 vulnerabilities were detected across all categories and tools in Thai banking applications. In contrast, non-Thai banks demonstrated a lower mean total vulnerability value of 14.25 (S.D. = 10.21), suggesting that fewer vulnerabilities were detected in these applications. For statistical significance, an independent samples \(t\)-test was conducted to compare these values. The analysis yielded a t-value of 2.35 with a \(p\)-value of 0.041. As this \(p\)-value is less than the conventional significance level of 0.05, we can conclude that the difference in total vulnerabilities between Thai and non-Thai banks is statistically significant. For further analysis, we compared the average number of vulnerabilities detected per bank type (Thai versus non-Thai) for each vulnerability category. The results are shown in Table 6.  
Table 6 presents a detailed comparison of the average number of vulnerabilities detected for Thai and non-Thai banks across each of the OWASP Mobile Top 10 vulnerability categories (M1-M10). This granular analysis provides insights into the specific security challenges faced by each group of banks. The first key finding is the consistent trend shown by Thai banking applications across all vulnerability categories. Thai banking applications show a higher average number of detected vulnerabilities compared to non-Thai banking applications. This aligns with the overall findings presented in Table 5, reinforcing the observation that Thai banks' mobile applications generally exhibit more security vulnerabilities. Moreover, in terms of most prevalent vulnerabilities, M9 (reverse engineering) shows the highest average (5.0), followed closely by M10 (extraneous functionality) and M5 (insufficient cryptography), which showed the average of 4.6 and 4.4, respectively. For non-Thai banking applications, however, M8 (code tampering) has the highest average (3.25), followed by M9 (2.75) and M5 (2.5). The most substantial differences between Thai and non-Thai banks can be observed in M10, whose average number of detected vulnerabilities is 4.6 for the Thai banking applications and only 2.0 for the non-Thai banking applications.