Apps More Vulnerable than OS, Report Says

While the Windows platform has become much more resistant to malware attacks, Microsoft-based applications have now become the focus of vulnerabilities, according to research firm Ovum.

"Microsoft's work in improving its Windows platform has been paying off and attackers are turning to attacking applications rather than platforms," said Graham Titterington, principal analyst at Ovum.

Microsoft's Security Intelligence report indicated that operating systems represented just over six percent of the total number of software vulnerabilities in the first half of 2008, compared with over 15 percent in 2003.

"Thus the majority of vulnerabilities are in applications and hackers are exploiting this opportunity," pointed out Titterington. "It is now critically important to patch vulnerabilities in all software that interacts with the Internet."

Microsoft accounted for nearly 10 percent of all disclosures in 2003, but only about three percent in 2008. This shows the success of its efforts to improve its software development processes since it embarked on its Trustworthy Computing Initiative, noted Titterington.

Fall in infection rates

The figures show a dramatic fall in infection rates with each stage in the development of the Windows platform, with the biggest single improvement coming with XP Service Pack 2.

According to the report, browser-based exploits represent a large proportion of attacks. Forty-seven percent of these came from China, pushing the US to second place with 23 percent. "This indicates the relative weakness of Internet security in China, and of its search engines in particular," said Titterington.

The amount of malware removed from computers worldwide increased by 43 percent over 2007, indicated the report.

Trojan downloaders accounted for 30 percent of this total, indicating the extent of the problem of hackers hijacking legitimate machines to act as malware servers. "This is a criminal activity," said Titterington. One of these has been found to have 86,000 variants (500 new versions per day).

There are wide variations in the total incidence of malware and the composition of malware across countries, reflecting their level of IT development (and hence their level of security deployment) and to a lesser extent social issues.