The number of malware code samples in the wild grew 30% to 410,000 in 2007, according to security researchers at IBM's ISS division. The Storm Worm, in particular, accounted for 13% of the entire malware collection.

IBM released these findings and more in its security trends report for 2007, which summarizes the threat landscape based on IBM's research on malware, software vulnerabilities, phishing and Web sites with questionable content.

While software vulnerabilities decreased 5.4% last year to 6,437 disclosures by vendors, the most risky "high-impact" vulnerabilities that allow immediate remote or local access increased from 16.2% in 2006, the first such increase noted since 2004.

Kris Lamb, operations manager at X-Force Research and Development at IBM ISS, says one thing that struck him about this year's threat analysis is that half of the software vulnerabilities reported by vendors in 2007 had no vendor patch available for them.

"It seems that vendors have not produced patches and we don't know why," Lamb says.

Microsoft  Apple, Oracle, IBM and Cisco, together accounted for 13.6% of the total number of vulnerabilities -- and left 20% of those vulnerabilities unpatched, the report points out.

On the spam front, average spam message size is down to pre-2005 levels, corresponding with a decrease in image-based spam, the 2007 IBM ISS report says.

The report also notes that 9% of Internet content can be classified as unwanted criminal, pornographic or "socially deviant" as compared with 12.5% last year. Socially deviant content is said to include political extremism, hate sites and groups advocating discrimination. The United States far outpaces other countries as the primary hosting source of this unwanted content, accounting for roughly 40% to 48% in each category.

In its malware-code analysis, IBM ISS says there's a shift from mass-mailing worms to sophisticated targeted Trojan attacks with rootkits and other blended threats. Trojans made up the single largest class of malware in 2007, accounting for 26% of the total. But IBM ISS believes that malware code is becoming less distinct as simply a virus, worm, spyware, backdoor or password stealer. "Modern malware is now the digital equivalent of the Swiss Army knife, and 2007 data continues to support this," the report concludes.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports