Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk //


04:52 PM

Security Holes In Software Decreased This Year, Early Data Shows

The number of vulnerabilities disclosed to the public fell in 2011, as did the proportion of flaws that were exploited. Is secure development paying off?

Cyberattackers had significant success in compromising companies in 2011, but a common vector of attack -- exploited software vulnerabilities -- could actually be on the decline.

The number of vulnerabilities disclosed publicly will fall in 2011, compared to the previous year, and far fewer flaws have been used to fuel attacks, according to early data from companies that collect vulnerability information.

Symantec, for example, expects to see a 30 percent drop in the total number of software vulnerabilities disclosed to the public this year, and a 10 percent decline in the number of critical vulnerabilities released to the public, according to its data. On an annual basis, the company typically documents some 4,500 to 5,500 flaws, though 2010 saw an exceptional 6,253 flaws reported. The company could see the lowest level of vulnerabilities reported in the past six years. IBM's X-Force security research teams has seen a similar trend.

A possible reason for the decline: The focus of companies, such as Microsoft and Adobe, on secure development could be eliminating much of the easy-to-find vulnerabilities, says Joshua Talbot, security intelligence manager for Symantec. "If an attacker knows that a particular platform has security mitigations and that exploitation is going to be difficult, the attackers may decide to not even go down that route," Talbot says.

In addition, attackers could be dissuaded by the fact that Windows, Linux, and Mac OS X, as well as many of the applications that run on those platforms, have been rebuilt with security features that make exploitation more difficult. While attackers continue to focus on vulnerabilities in Adobe Acrobat, Oracle's Java, and Microsoft's Office, security researchers have put increasing effort into auditing more niche software, such as industrial-control systems, automotive systems, and mobile devices.

"It is hard to say exactly what is driving the motives of researchers or attackers," Talbot says. "But there have been developments that have hampered exploit development and that may have motivated attackers to keep vulnerabilities and exploits private and not report them."

Take Adobe, for example. Researchers started focusing on the company in 2008; the number of vulnerabilities reported to the company took off the following year and peaked in 2010. This year, however, the company is seeing a significant drop in reported vulnerabilities. The number of flaws reported in Flash Player have dropped by half, and the number of flaws in Acrobat has dropped by two-thirds, says Brad Arkin, senior director for security at Adobe.

"What is very important to us is to drive the cost up of finding an exploit and making it more expensive," Arkin says. "This is our big effort and our big focus."

It's a trend that Microsoft has seen in its own data. In 2011, the number of critical vulnerabilities in the company's software fell to its lowest level in six years. In addition, the company issued 99 bulletins in 2011, down from 106 in 2010. In absolute numbers, that means critical vulnerabilities are at their lowest level since 2005.

[HP's Zero Day Initiative says most new bugs were in major software vendors' wares . See Zero Day Initiative: One Year After Throwing Down The Disclosure Gauntlet. ]

"The fact that we're seeing lower percentages of Critical issues and bulletins year-over-year demonstrates the progress made by the product groups in creating more secure software," Mike Reavey, senior director of the Microsoft Security Response Center, said in a blog post about the data.

Ever since the company kicked off its Trustworthy Computing Initiative in January 2002, the company has focused on eliminating vulnerabilities in its software, improving its development process, and making its operating systems and applications harder to exploit. The latest data suggests the company has had some success.

Yet while a focus on security in major software platforms and applications might have hardened that software against easy exploitation, researchers have already moved to other systems that have lacked rigorous vetting, such as embedded systems in automotive applications, industrial-control systems, and medical devices. As more of these devices become Internet connected, attackers will find ways of targeting them, says Wolfgang Kandek, chief technology officer of vulnerability management firm Qualys.

"I believe that we are connecting things to the Internet at such a rapid pace that I don't think there will be a lack of vulnerabilities," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
PUBLISHED: 2021-04-16
jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...
PUBLISHED: 2021-04-16
Portofino is an open source web development framework. Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens. This allows forging a valid JWT. The issue will be patched in the upcoming 5.2.1 release.
PUBLISHED: 2021-04-16
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this ...
PUBLISHED: 2021-04-16
jose-browser-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDec...