Security Holes In Software Decreased This Year, Early Data Shows

Cyberattackers had significant success in compromising companies in 2011, but a common vector of attack -- exploited software vulnerabilities -- could actually be on the decline.

The number of vulnerabilities disclosed publicly will fall in 2011, compared to the previous year, and far fewer flaws have been used to fuel attacks, according to early data from companies that collect vulnerability information.

Symantec, for example, expects to see a 30 percent drop in the total number of software vulnerabilities disclosed to the public this year, and a 10 percent decline in the number of critical vulnerabilities released to the public, according to its data. On an annual basis, the company typically documents some 4,500 to 5,500 flaws, though 2010 saw an exceptional 6,253 flaws reported. The company could see the lowest level of vulnerabilities reported in the past six years. IBM's X-Force security research teams has seen a similar trend.

A possible reason for the decline: The focus of companies, such as Microsoft and Adobe, on secure development could be eliminating much of the easy-to-find vulnerabilities, says Joshua Talbot, security intelligence manager for Symantec. "If an attacker knows that a particular platform has security mitigations and that exploitation is going to be difficult, the attackers may decide to not even go down that route," Talbot says.

In addition, attackers could be dissuaded by the fact that Windows, Linux, and Mac OS X, as well as many of the applications that run on those platforms, have been rebuilt with security features that make exploitation more difficult. While attackers continue to focus on vulnerabilities in Adobe Acrobat, Oracle's Java, and Microsoft's Office, security researchers have put increasing effort into auditing more niche software, such as industrial-control systems, automotive systems, and mobile devices.

"It is hard to say exactly what is driving the motives of researchers or attackers," Talbot says. "But there have been developments that have hampered exploit development and that may have motivated attackers to keep vulnerabilities and exploits private and not report them."

Take Adobe, for example. Researchers started focusing on the company in 2008; the number of vulnerabilities reported to the company took off the following year and peaked in 2010. This year, however, the company is seeing a significant drop in reported vulnerabilities. The number of flaws reported in Flash Player have dropped by half, and the number of flaws in Acrobat has dropped by two-thirds, says Brad Arkin, senior director for security at Adobe.

"What is very important to us is to drive the cost up of finding an exploit and making it more expensive," Arkin says. "This is our big effort and our big focus."

It's a trend that Microsoft has seen in its own data. In 2011, the number of critical vulnerabilities in the company's software fell to its lowest level in six years. In addition, the company issued 99 bulletins in 2011, down from 106 in 2010. In absolute numbers, that means critical vulnerabilities are at their lowest level since 2005.

[HP's Zero Day Initiative says most new bugs were in major software vendors' wares . See Zero Day Initiative: One Year After Throwing Down The Disclosure Gauntlet. ]

"The fact that we're seeing lower percentages of Critical issues and bulletins year-over-year demonstrates the progress made by the product groups in creating more secure software," Mike Reavey, senior director of the Microsoft Security Response Center, said in a blog post about the data.

Ever since the company kicked off its Trustworthy Computing Initiative in January 2002, the company has focused on eliminating vulnerabilities in its software, improving its development process, and making its operating systems and applications harder to exploit. The latest data suggests the company has had some success.

Yet while a focus on security in major software platforms and applications might have hardened that software against easy exploitation, researchers have already moved to other systems that have lacked rigorous vetting, such as embedded systems in automotive applications, industrial-control systems, and medical devices. As more of these devices become Internet connected, attackers will find ways of targeting them, says Wolfgang Kandek, chief technology officer of vulnerability management firm Qualys.

"I believe that we are connecting things to the Internet at such a rapid pace that I don't think there will be a lack of vulnerabilities," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.