The malware underworld grew more complex during the first half of 2007, despite a decrease in the number of disclosed vulnerabilities, according to statistics provided by IBM Internet Security Systems' X-Force Labs.
X-Force reported a growing “exploit-leasing” market, where researchers rent exploits to attackers, thereby seeing a return on their initial investment.
That movement built on the “exploits-as-a-service” trend that researchers said took hold last year when managed exploit providers were first seen purchasing malicious code from the criminal underground, encrypting it and selling it to spam distributors.
Kris Lamb, X-Force director, said this week that cyberattackers have grown shrewder in carrying out for-profit schemes.
“The X-Force security statistics for 2006 predicted a continued rise in the sophistication of targeted, profit-motivated cyberattacks,” said Lamb. “This directly correlates to the rise in popularity of trojans that we are witnessing this year, as trojans are often used by attackers to launch sustained, targeted attacks.”
The number of disclosed vulnerabilities dropped during the first half of 2007 – the first time X-Force has noted a decrease in its nine years of recording flaws.
The 3,273 vulnerabilities disclosed during 2007 is a 3.3 percent drop from the first half of 2006.
January was the biggest month of 2007 for flaw discovery, with 600 flaws registered – 146 of which were discovered during the week of Jan. 15-21.
The most popular day of the week for vulnerability disclosure this year is Tuesday – the same day Microsoft releases its monthly patch bundles – accounting for 25 percent of all flaws.
Microsoft, Apple and Oracle were the most vulnerable vendors for the first half of 2007, according to the report.
X-Force researchers also noticed a surprise drop in the average size of spam messages, a result of spammers moving on from image spam emails that were popularized earlier this year.
“The decrease in spam message size and image-based spam is a result of spammers adopting and experimenting with newer techniques, such as PDF- and Excel-based spam, as a means to more successfully evade detection by anti-spam technologies,” said Lamb.
X-Force reported a growing “exploit-leasing” market, where researchers rent exploits to attackers, thereby seeing a return on their initial investment.
That movement built on the “exploits-as-a-service” trend that researchers said took hold last year when managed exploit providers were first seen purchasing malicious code from the criminal underground, encrypting it and selling it to spam distributors.
Kris Lamb, X-Force director, said this week that cyberattackers have grown shrewder in carrying out for-profit schemes.
“The X-Force security statistics for 2006 predicted a continued rise in the sophistication of targeted, profit-motivated cyberattacks,” said Lamb. “This directly correlates to the rise in popularity of trojans that we are witnessing this year, as trojans are often used by attackers to launch sustained, targeted attacks.”
The number of disclosed vulnerabilities dropped during the first half of 2007 – the first time X-Force has noted a decrease in its nine years of recording flaws.
The 3,273 vulnerabilities disclosed during 2007 is a 3.3 percent drop from the first half of 2006.
January was the biggest month of 2007 for flaw discovery, with 600 flaws registered – 146 of which were discovered during the week of Jan. 15-21.
The most popular day of the week for vulnerability disclosure this year is Tuesday – the same day Microsoft releases its monthly patch bundles – accounting for 25 percent of all flaws.
Microsoft, Apple and Oracle were the most vulnerable vendors for the first half of 2007, according to the report.
X-Force researchers also noticed a surprise drop in the average size of spam messages, a result of spammers moving on from image spam emails that were popularized earlier this year.
“The decrease in spam message size and image-based spam is a result of spammers adopting and experimenting with newer techniques, such as PDF- and Excel-based spam, as a means to more successfully evade detection by anti-spam technologies,” said Lamb.
