Numbers: Software Vulnerabilities Spike

The annual IBM Internet Security Systems security trends report published Tuesday shows 7,427 software bugs were cataloged last year, an increase of 39.5 percent over the number of vulnerabilities identified in 2005.

IBM listed itself among the top 10 vendors, whose products accounted for 964 of the 7,424 disclosed software vulnerabilities. According to the report, the top 10 vendors for last year, in descending order, are: Microsoft, Oracle, Apple, Mozilla, IBM, Linux Kernel Organization, Sun, Cisco, HP and Adobe Systems.

The report says 86 percent of the top 10 vendors’ publicly disclosed vulnerabilities received a software patch.

The remaining balance of the 2006 vulnerabilities are ascribed to “other vendors,” and 65 percent of these software flaws were patched, according the IBM ISS report.

The 39.5 percent spike in the number of vulnerabilities can be attributed to the type of tools security experts use now to evaluate software, said Gunter Ollmann, director of the X-Force research and rapid-response division within Internet Security Systems. “The use of fuzzing technology in the automated tools can find where bugs lie,” Ollman said.

Automated fuzzing tools typically run scripts that are tuned to throw garbled data at an application and see how it handles it, revealing many unwanted code-execution risks. These are often cataloged as medium risks, rather than high or low risk.

In general, the number of vulnerabilities discovered each year has been growing since 2000, and the risks associated with those vulnerabilities have been getting worse. In 2000, only 43.6 percent of vulnerabilities could be remotely exploited, but in 2006, that number reached 88.4 percent, according to the report.

Spam and phishing trends also are changing.

For one, spam messages have grown in size over the past two years, increasing from an average of 6KB to 9.5KB. “This is largely due to the increased inclusion of random data designed to help spam bypass the first-generation antispam technologies, and the use of images to convey message content,” the IBM ISS report states.

The report also found that spam messages are overwhelmingly sent in English, with German, Korean, Portuguese and Russian the only others appearing in any amount worth noting.

Geographically, IBM ISS points to South Korea (16.33 percent), Spain (14.71 percent), the United States (10.95 percent), France (9.92 percent), Brazil (6.76 percent), Israel (6.41 percent), Germany (5.27 percent), Italy (4.34 percent), Poland (3.28 percent) and Argentina (2.64 percent) as source countries with the greatest measured volumes of phishing e-mail transmitted.

Top phishing target countries, where the most phishing e-mail is received, are said to be the United States (71.37 percent), United Kingdom (4.96 percent), Germany (4.58 percent), Australia (2.67 percent) and Canada (2.67 percent).

The report also takes a stab at interpreting growth in unwanted content, including violence and crime, pornography, computer-related crime and drug-dealing sites. In terms of websites, the United States tops the list in every category and accounts for more than 50 percent in each case, according to the IBM ISS report.

When it comes to the most frequently seen malware, the Downloader Trojan turned up the most in 2006, according to IBM ISS.