Remotely Exploitable Attacks on the Rise

IBM Internet Security Systems (ISS) has released its latest trends report, X-Force 2007 Trend Statistics. The report highlights the many security problems of 2007.

In 2007 only 9% of all Internet content was classified as unwanted content. This is down from 12.5% in 2006. 2007 was also the first year were there was a decrease in vulnerabilities found. In 2006, 6,803 vulnerabilities were found. In 2007, only 6,437 vulnerabilities were found. Although the report states that this could be an anomaly it is a good sign.

However, remotely exploitable vulnerabilities have reached an all time high. In 2000, the number of remote vulnerabilities accounted for 43.6% of all attacks. In 2007, the number rose to 89.4%.

Gunter Ollmann, Director of Security Strategy at IBM?s ISS, wrote in his blog, ?I believe that this percentage increase in remote exploitability reflects a parallel increase in the general networked and integrated applications that we use today. Projecting forward in time, I?d expect to see this trend towards a greater proportion of remotely exploitable vulnerabilities to continue as the software industry increasingly incorporates network functionality into its new applications and functionality updates.?

Ollmann highlighted the need for a complete updating platform that can apply needed security patches for all software on a computer system. ?Microsoft has done an OK job so far with their Windows Update feature ? but I really do think that their updating mechanism needs to expand and encompass other vendor?s software, and for it to become a complete updating platform.?