# Comparative Vulnerability Analysis of Thai and Non-Thai Mobile Banking Applications
## 2 Background and Related Work
### Related Work  
The vulnerability analysis of mobile banking applications is a crucial aspect of ensuring the security of financial transactions. Several studies have focused on identifying vulnerabilities in mobile banking applications across different regions and countries. This section provides an overview of the existing research on vulnerability analysis in mobile banking applications. In the global perspective of mobile banking applications, a study analysed the vulnerability of mobile banking and payment applications on Android in African countries [7]. The researchers used AndroBugs, a vulnerability scanner, to identify vulnerabilities in six digital banks' Android applications. The results showed that all the scanned applications had vulnerabilities, with Revolut's application having the highest number of identified vulnerabilities. Another study assessed the security and privacy features of mobile banking applications across multiple countries using the MobSF tool [16]. The results revealed various vulnerabilities, including insecure data storage, weak encryption, and the presence of sensitive information hardcoded in the application's code. The researchers also stressed \begin{table}
\begin{tabular}{c c c} \hline \hline
**Category** & **Threat** & **Description** \\ \hline M1 & Improper Platform Usage & Misuse of a platform (Android, in this case) feature and failure to use security controls provided by the platform. \\ M2 & Insecure Data Storage & Sensitive data such as passwords or financial information stored on the device without proper encryption is vulnerable to theft and leakage. \\ M3 & Insecure Communication & Unencrypted data transmission over public networks allows attackers to intercept sensitive information. \\ M4 & Insecure Authentication & Flawed mechanisms for user verification and access control can leave user data exposed. \\ M5 & Insufficient Cryptography & Weak encryption algorithms or improper key management practices can leave data related to users and applications vulnerable to decryption. \\ M6 & Insecure Authorisation & Inadequate verification and validation of identity and permission of a user in the application. \\ M7 & Client Code Quality & Low quality and insecurity of the code that runs directly on a mobile device, making the code potentially exploitable. \\ M8 & Code Tampering & Unauthorised modification of the application’s code to alter its behaviour, which can result in malicious functions being introduced. \\ M9 & Reverse Engineering & Lack of mechanisms to protect the application’s code from reverse engineering can expose vulnerabilities. \\ M10 & Extraneous Functionality & Presence of any code or feature within the application that serves no purpose and can potentially expose the application to security risks. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: OWASP Mobile Top 10.  
the need for comprehensive vulnerability assessment, including both static and dynamic analysis, to ensure the security of mobile banking applications. Moreover, research focused on the vulnerability analysis of digital banks' mobile applications in the United Kingdom (UK) [13]. The study also used AndroBugs to scan the applications. The results indicated that all the scanned applications had vulnerabilities. However, the study was limited to only six digital banks in the UK, and the findings may not be generalisable to other regions or a broader set of mobile banking applications. Apart from the UK, there was also a study that carried out a security analysis of mobile banking applications in Qatar [15]. This research used a combination of mobile testing frameworks to assess the security posture of two mobile banking applications. The results highlighted various security weaknesses, such as insecure data storage and the failure in hiding sensitive information in the application's code, suggesting the need for a more robust security evaluation of mobile banking applications in the region. In addition, [PERSON] et al.