IBM X-Force Security Report: Web Browsers Under Siege From Organized Crime

IBM (NYSE: IBM) today released the findings of the 2007 X-Force Security report, detailing a disturbing rise in the sophistication of attacks by criminals on Web browsers worldwide. According to IBM, by attacking the browsers of computer users, cybercriminals are now stealing the identities and controlling the computers of consumers at a rate never before seen on the Internet.

The study finds that a complex and sophisticated criminal economy has developed to capitalize on Web vulnerabilities. Underground brokers are delivering tools to aid in obfuscation, or camouflaging attacks on browsers, so cybercriminals can avoid detection by security software. In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007, and reached nearly 100 percent by the end of the year. The X-Force believes the criminal element will contribute to a proliferation of attacks in 2008.

Using these techniques, cybercriminals can infiltrate a user's system and steal their IDs and passwords or obtain personal information like National Identification numbers, Social Security numbers and credit card information. When attackers invade an enterprise machine, they could steal sensitive company information or use the compromised machine to gain access to other corporate assets behind the firewall.

"Never before have such aggressive measures been sustained by Internet attackers towards infection, propagation and security evasion. While computer security professionals can claim some victories, attackers are adapting their approaches and continuing to have an impact on users' experiences," said Kris Lamb, operations manager, X-Force Research and Development for IBM Internet Security Systems. "The Storm Worm provides a microcosm of the kinds of threats users faced in 2007. All in all, the exploits used to spread Storm Worm are a blend of the various threats tracked by X-Force, including spam, phishing and drive-by-downloads by way of Web browser exploitation."

The Storm Worm, the most pervasive Internet attack last year, continues to infect computers around the world through a culmination of the threats the X-Force tracks, including malicious software (malware), spam and phishing. Last year, delivery of malware was at an all time high, as X-Force reported a 30 percent rise in the number of malcode samples identified. The Storm Worm comprised around 13 percent of the entire malcode set collected in 2007.

In other findings, for the first time ever, the size of spam emails decreased sharply to pre-2005 levels. X-Force believes the decrease is linked to the drop off of image-based spam. This decrease can be counted as a win for the security industry -- as anti-spam technologies became more efficient at detecting image-based spam, spammers were forced to turn to new techniques.

The X-Force has been cataloguing, analyzing and researching vulnerability disclosures since 1997. With more than 33,000 security vulnerabilities catalogued, it has the largest vulnerability database in the world. This unique database helps X-Force researchers to understand the dynamics that make up vulnerability discovery and disclosure.

The new X-Force report from IBM also reveals that:

The number of critical computer security vulnerabilities disclosed increased by 28 percent, a substantial upswing from years past.
The overall number of vulnerabilities reported for the year went down for the first time in 10 years.
Out of all the vulnerabilities disclosed last year, only 50 percent can be corrected through vendor patches.
Nearly 90 percent of 2007 disclosed vulnerabilities are remotely exploitable.

IBM is the world's leading provider of risk and security solutions. Clients around the world partner with IBM to help reduce the complexities of security and strategically manage risk. IBM's experience and range of risk and security solutions are unsurpassed -- from dedicated research, software, hardware, services and global business partner value -- helping clients secure business operations and implement company-wide, integrated risk management programs.

For more security trends and predictions from IBM, including graphical representations of security statistics, please access the full "2007 X-Force Trends Statistics" at: http://www-935.ibm.com/services/us/index.wss/offerfamily/iss/a1029112

Dell Adds Anti-Theft Security for Notebook Computers

Dell and Absolute Software have teamed to provide notebook computer theft recovery services for Dell’s U.S. consumer customers.

The move makes Dell the first PC manufacturer to deliver a higher degree of peace of mind by combining theft recovery measures with accidental damage protection.

With the purchase of select DellTM InspironTM notebooks, customers who opt for CompleteCare Accidental Damage Service1 with prices ranging from $99 to $139, now will receive Computrace® LoJack® for Laptops2 theft recovery service, valued at between $49 and $119 This service is available for systems with 1 - 4 year warranties.

Dell’s CompleteCareTM Accidental Damage Service, available in most states, provides coverage for issues not covered under the standard limited warranty. These include spills, drops and electrical surges. Computrace LoJack for Laptops gives consumers additional benefits by providing security software that helps track down a notebook computer if lost or stolen and helps protect any personal data on the system.

“Losing a computer is costly, even potentially devastating, when you consider the value of the data and personal information stored on today’s notebooks,” said Rocky Mountain, of Dell’s U.S. Consumer business. “Combining accidental damage protection with theft recovery service is a huge win for consumers who want increased security.”

Dawn Burnett, a student at the University of Massachusetts, found this out the hard way. “When I purchased my Dell notebook last year, I wanted to keep my investment safe and secure, so I bought both CompleteCare and the LoJack for Laptops,” Burnett said. “It really paid off when my computer was stolen from my dorm room. The companies came to my rescue. Absolute tracked down and recovered my computer, and Dell fixed the damage that occurred during the theft.”

“Mobile computing is becoming the standard for individual consumers, and with it comes increased exposure to identity theft and data loss from loss or theft,” said John Livingston, chairman and CEO of Absolute Software. “Dell clearly understands this risk and has become the first PC manufacturer to offer an integrated accidental damage and theft recovery solution to help protect its customers.”

“Absolute has been reuniting Dell business and institutional customers with their lost and stolen notebooks for almost 10 years and looks forward to extending our industry-leading theft protection service to Dell’s home users,” said Livingston.

Computrace LoJack for Laptops is also available for purchase as a standalone product on the Dell Software and Peripherals site for prices ranging from $49 - 139.

Dell received the Computer Shopper 2006 Shoppers’ Choice Award for best customer service and support recently. This caps off a year when Dell invested $150 million in customer service and support improvements.




1 CompleteCare Accidental Damage Service: CompleteCare service excludes theft, loss, and damage due to fire, flood or other acts of nature, or intentional damage. CompleteCare not available in all states. Customer may be required to return unit to Dell. For complete details, visit www.dell.com/servicecontracts


2 Computrace LoJack for Laptops: Not a Dell offer. Certain conditions apply. Only if the Customer Computer has not been Recovered during the Recovery Period and the Customer has fully complied with all of the Money-Back Guarantee Terms and Conditions: CRI or ASC will pay the Customer the lesser of the amount equal to the actual price paid by the customer for the recovery service (exclusive of taxes, shipping or handling charges) or the U.S. Suggested Retail Price for the Service Term purchased, regardless of the amount of service remaining. For full details, see terms and conditions at www.lojackforlaptops.com