Assessing security vulnerabilities in Sri Lankan banking mobile applications: challenges and solutions.

Ravichandran, Lavanya; Piyumantha, Kavindu; Wickramasinghe, Waruna Sri; Weerasinghe, Malshan; Senanayake, Janaka

Abstract

Mobile banking plays a crucial role in Sri Lanka's financial sector, offering convenience through self-service technologies. Despite its rapid adoption, concerns about security continue to affect customer trust, underscoring the critical need for enhanced protections and user experience. This study examines the security vulnerabilities present in mobile banking applications in Sri Lanka, evaluating their compliance with established security standards and the effectiveness of their security measures. Utilizing a quantitative methodology, the research employed the Mobile Security Framework (MobSF) to conduct static analysis on 17 mobile banking and digital wallet applications, selected to comprehensively represent nearly all mobile banking apps available in Sri Lanka. The findings reveal significant security flaws, including weak encryption methods, insecure data storage practices, and the absence of runtime integrity checks, resulting in widespread deviation from best practices. Most applications were classified as medium risk due to notable vulnerabilities. The research underscores the need for enhanced security protocols to safeguard user data, uphold customer trust, and ensure compliance with regulatory standards. It also identifies key areas for future research, including the integration of dynamic analysis, implementing real-time threat monitoring, and improving user awareness to mitigate risks and enhance the security landscape of mobile banking in Sri Lanka.

Citation

RAVICHANDRAN, L., PIYUMANTHA, K., WICKRAMASINGHE, W.S., WEERASINGHE, M. and SENANAYAKE, J. 2025. Assessing security vulnerabilities in Sri Lankan banking mobile applications: challenges and solutions. In Proceedings of the 8th International research conference on Smart computing and systems Engineering 2025 (SCSE 2025), 3 April 2025, Colombo, Sri Lanka. Piscataway: IEEE [online], pages 1-6. Available from: https://doi.org/10.1109/SCSE65633.2025.11031031

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 8th International research conference on Smart computing and systems engineering 2025 (SCSE 2025)
• Start Date: Apr 3, 2025
• Acceptance Date: Feb 7, 2025
• Online Publication Date: Apr 3, 2025
• Publication Date: Apr 3, 2025
• Deposit Date: Jun 20, 2025
• Publicly Available Date: Jul 8, 2025
• Publisher: Institute of Electrical and Electronics Engineers (IEEE)
• Peer Reviewed: Peer Reviewed
• Pages: 1-6
• Series ISSN: 2613-8662
• DOI: https://doi.org/10.1109/SCSE65633.2025.11031031
• Keywords: Android security vulnerabilities; Data protection; Encryption practices; Mobile banking; Mobile security framework
• Public URL: https://rgu-repository.worktribe.com/output/2885900