[lotuseclat79]

Ars Technica article here.

IBM Internet Security System's X-Force has released its annual report (PDF) on malware trends and statistics from last year. 2007 saw some significant changes in malware distribution, and there's reason to think that some of these shifts mark the beginning of new attack patterns rather than small abnormalities. The following are some of the highlights from the report:

* Reported vulnerabilities in 2007 were down five percent compared to 2006, but the number of those vulnerabilities that were classified as severe rose by 28 percent.
* Microsoft, Apple, Oracle, IBM, and Cisco reported the most vulnerabilities, but collectively account for only 13.6 percent of all reported vulnerabilities.
* 90 percent of the 2007 vulnerabilities were exploitable from a remote location, up 1 percent from 2006
* Most in-the-wild exploits are being generated by web toolkits. Prevalence of these toolkits has risen dramatically since they appeared in 2006.

As of this writing, 80 percent of the 838 vulnerabilities attributed to the top five vendors have been patched. That leaves 20 percent of the flaws unpatched, which is obviously non-ideal, but it beats the 50/50 patched/unpatched ratio attributed to the other vendors once Microsoft, Apple, Oracle, IBM, and Cisco are removed from the picture.

-- Tom