IBM put out a new report (embedded below) on security threats to enterprise computer networks today from its X-Force security research group. It found a 36 percent increase in security vulnerabilities, with Web applications being the main culprit. Web apps with security exploits accounted for 55 percent of all disclosed vulnerabilities.

One of the biggest threats are hidden attacks using Javascript. There was a 52 percent rise in such “obfuscated attacks” in the first half of 2010. The increased adoption of cloud computing and virtualization brings with it its own security threats. For instance, 35 percent of virtualization vulnerabilities affect the hypervisor, meaning that gaining control of one virtual machine can give attackers controls of other machines on the same system.

Another increasing source of attacks come from PDF exploits, which usually are downloaded unsuspectingly through links on Websites. Malicious PDFs spiked 37 percent, and those are just the ones that were detected. PDF exploits are being used to spread the Zeus and Pushdo botnets.

Interestingly, run-of-the-mill phishing scams seem to be down, with an 82 percent decline since their peak last year. But They are still the single biggest threat for financial institutions, which make up about half of all phishing targets, followed by credit cards, the government, online payments, and auctions.

The report also ranks the vendors by percentage of unpatched vulnerabilities.  Sun, which is now owned by Oracle, tops the list with 24 percent unpatched vulnerabilities, compared to 2.6 percent last year during the same period.  Microsoft is second with 23 percent, Mozilla is third with 21 percent, Apple is fourth with 13 percent, and IBM is fifth with 10 percent.

Update: It looks like IBM was forced to revise some of its numbers and methodology, and is itself now the company with the most unresolved “critical” security bugs with no patches over the past six months (29 percent). In terms of overall unpatched vulnerabilities (not just the critical ones), Microsoft now tops that list with 23 percent, followed by Mozilla (17 percent), Apple (12 percent), IBM (9 percent), and then Sun (8 percent). Oops.

IBM X-Force Vulnerability Threats 1H2010

Crunch Network: CrunchBase the free database of technology companies, people, and investors

Salesforce Chatter just went live to all customers earlier today, but already it is being attacked from below by smaller social CRM players. Taking a page from Salesforce CEO Marc Benioff’s own playbook of getting attention by going after larger incumbents, Bantam Live CEO John Rourke likens Chatter to lipstick on a pig. The pig in question is the underlying Salesforce app which he describes as having “the interface only the mother of a database technician could love.”

Now that he’s got your attention, what Rourke really wants to tell you is that Bantam Live is the social CRM for small businesses. Bantam Live launched last year at one of our Realtime Crunchups, and it came out of beta last February. A couple weeks ago, I got him on video talking about his approach to social CRM and how he positions Bantam Live against the Salesforce juggernaut. He also gave me a demo of his social enterprise app. (Watch the videos below).

Bantam Live is a Web-based communications and collaboration tool for businesses. It’s like Yammer with project management and CRM features. Everyone in a company can talk to each other privately in a stream and keep track of deals collectively, while outside conversations from Twitter and elsewhere can also be pulled in. You can monitor Twitter conversations and reply to them from within Bantam Live, and even create contacts from Twitter account names.

Bantam Live has been adding a ton of new features to try to stay one step ahead of Salesforce. The app now works with Google contacts, Google Buzz, Google Calendar, and Google Docs (it will soon be added to the Google Apps Marketplace). Contacts in Bantam Live are now matched up to their social profiles across the Web. It is integrated with email app Rapportive, and Mailchimp is coming up. There are also new icons in the activity stream to give visual cues when deals are modified. And there is an API.

Trash talk aside and parody commercials, competition is good for the evolution of social CRM. It keeps everyone on their toes.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

Thousands of developers rely on Twitter’s APIs to build their apps and Websites. In time for this week’s Chirp conference for Twitter developers, Apigee is coming out of public beta and launching a special dashboard to keep track of the Twitter API.

Apigee is a Google Analytics for APIs. For developers who rely on data from other sites and companies, it monitors how much data they are using (message requests), the error rate, response times, and downstream users. For the Twitter API, Apigee added the number of Tweets and retweets going through a developers app, as well as the location of users on a map for geo-coded tweets. For instance a developer with a Twitter iPhone client could use Apigee to monitor how many times an hour his app is making data calls to Twitter.

Since Twitter places rate limits on developers in terms of how many Tweets per hour and other data can go through their apps, keeping track of that usage is important to be able to manage that for developers. One added bonus for smaller developers who are not on Twitter’s whitelist is that if they access Twitter’s APIs through Apigee via OAuth they get upgraded to Apigee’s 20,000 requests/hour (compared to 150 requests per hour for many developers).

Apigee also includes a handy API debugger and the service is free.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.