Blended security threats on the rise, IBM says

The number of malware code samples in the wild grew 30 percent to 410,000 in 2007, according to security researchers at IBM’s ISS division. The Storm worm in particular accounted for 13 percent of the entire malware collection.

IBM released these findings and more in its security trends report for 2007, which summarizes the threat landscape based on IBM’s research on malware, software vulnerabilities, phishing, and Web sites with questionable content.

While software vulnerabilities decreased 5.4 percent last year to 6,437 disclosures by vendors, the most risky “high impact” vulnerabilities that allow immediate remote or local access increased from 16.2 percent in 2006, the first such increase noted since 2004.

Kris Lamb, operations manager at X-Force Research and Development at IBM ISS, says one thing that struck him about this year’s threat analysis is that half of the software vulnerabilities reported by vendors in 2007 had no vendor patch available for them.

“It seems that vendors have not produced patches, and we don’t know why,” Lamb says.

Microsoft, Apple, Oracle, IBM, and Cisco, together accounted for 13.6 percent of the total number of vulnerabilities — and left 20 percent of those vulnerabilities unpatched, the report points out.

On the spam front, average spam message size is down to pre-2005 levels, corresponding with a decrease in image-based spam, the 2007 IBM ISS report says.

The report also notes that 9 percent of Internet content can be classified as unwanted criminal, pornographic, or “socially deviant” as compared with 12.5 percent last year. Socially deviant content is said to include political extremism, hate sites, and groups advocating discrimination. The United States far outpaces other countries as the primary hosting source of this unwanted content, accounting for roughly 40 percent to 48 percent in each category.

In its malware-code analysis, IBM ISS says there’s a shift from mass-mailing worms to sophisticated targeted Trojan attacks with rootkits and other blended threats. Trojans made up the single largest class of malware in 2007, accounting for 26 percent of the total. But IBM ISS believes that malware code is becoming less distinct as simply a virus, worm, spyware, backdoor, or password stealer.

“Modern malware is now the digital equivalent of the Swiss Army knife, and 2007 data continues to support this,” the report concludes.