​Think Apple apps are safer than Android? Think again

Apple has a good reputation for security. But a new report finds that its good reputation could be working against it.

Software security testing company Checkmarx and mobile app experts at AppSec Labs looked at hundreds of apps for Android and iOS devices and found that each app had an average of nine vulnerabilities that could leave users open to data theft.

Checkmarx marketing vice president Asaph Schulman called the results "nothing short of alarming" and said that if app developers don't institute better coding practices, "we should expect an increase of major hacks...in the near future."

Thirty-eight percent of the vulnerabilities the researchers identified in the code of a range of app types (including ones, such as banking apps, that handle very sensitive information) were categorized as being of high or critical severity, meaning that a hacker could break in with relative ease.

When they compared iOS to Android apps, they found the Apple apps actually had a higher percentage of high vulnerabilities -- 40 percent to 36 percent. The irony? This discrepancy might be a result of Apple's focus on security.

"There's a myth that iOS apps are more secure than Android. But the truth is, iOS apps are even worse in terms of security," said Erez Metula, founder of AppSec Labs. "When we do penetration testing for our customers, we're often asked to test their Android and iOS versions of the same app. We have realized that since iOS developers incorrectly assume that iOS is 'more secure,' they allow themselves to make bad security decisions that open up vulnerabilities in their app."

He added, "Interestingly, since Android developers think that Android security is worse, it pressures them to follow better security practices."

Developers willfully bypassing standard protocol were responsible for thousands of apps in Apple's App Store that were infected with malware from counterfeit code. Revealed in September, the XcodeGhost malware is still active in the U.S. and has even taken a new, more elusive form, according to FireEye security experts.

"Software developers need to realize that the security of the apps they produce and publish are entirely dependent on their development toolchain," said Tod Beardsley, senior research manager at Rapid7, a cybersecurity firm.

Checkmarx and AppSec Labs concluded that one of the key steps to ensuring safer mobile apps is educating developers about best practices for protecting their own creations.