Think Apple apps are safer than Android? Think again.

8 Nov 2015 | Apple has a good reputation for security. But a new report finds that its good reputation could be working against it.

Software security testing company Checkmarx and mobile app experts at AppSec Labs looked at hundreds of apps for Android and iOS devices and found that each app had an average of nine vulnerabilities that could leave users open to data theft.

Checkmarx marketing vice president Asaph Schulman called the results "nothing short of alarming" and said that if app developers don't institute better coding practices, "we should expect an increase of major hacks...in the near future."

Thirty-eight percent of the vulnerabilities the researchers identified in the code of a range of app types (including ones, such as banking apps, that handle very sensitive information) were categorized as being of high or critical severity, meaning that a hacker could break in with relative ease.

When they compared iOS to Android apps, they found the Apple apps actually had a higher percentage of high vulnerabilities -- 40 percent to 36 percent. The irony? This discrepancy might be a result of Apple's focus on security.

Developers willfully bypassing standard protocol were responsible for thousands of apps in Apple's App Store that were infected with malware from counterfeit code. Revealed in September, the XcodeGhost malware is still active in the U.S. and has even taken a new, more elusive form, according to FireEye security experts.

"Software developers need to realize that the security of the apps they produce and publish are entirely dependent on their development toolchain," said Tod Beardsley, senior research manager at Rapid7, a cybersecurity firm.

Checkmarx and AppSec Labs concluded that one of the key steps to ensuring safer mobile apps is educating developers about best practices for protecting their own creations.

Read the full article here

Interested in trying CxSAST on your own code? You can now use Checkmarx's solution to scan uncompiled / unbuilt source code in 18 coding and scripting languages and identify the vulnerable lines of code. CxSAST will even find the best-fix locations for you and suggest the best remediation techniques. Sign up for your FREE trial now.

Checkmarx is now offering you the opportunity to see how CxSAST identifies application-layer vulnerabilities in real-time. Our in-house security experts will run the scan and demonstrate how the solution's queries can be tweaked as per your specific needs and requirements. Fill in your details and we'll schedule a FREE live demo with you.