Well at least someone had a good 2008: The high-tech criminal underground, which used the year of living desperately to pump out a banner collection of malware, spam, and online scams.

The BBC reports that security company Sophos says it tracked over 20,000 new malicious programs being released every day during 2008, and Symantec's anti-virus database finally topped one million entries.

One of the biggest security-oriented stories of the year hit only weeks ago, when a flaw in Internet Explorer could have opened up the malware floodgates (but was thankfully patched quickly). And even moi got hit with a malware attack in 2008 for the first time this decade.

If it seems like things are getting worse at there, it's because they are: As the BBC notes, wily crooks have figured out that it's easier to slip an attack through if they arrive in numbers. Big, widespread, and widely-reported security flaws (like the IE problem) get lots of attention and the holes are quickly closed. But with thousands of smallish attacks released every day it's impossible for every security firm to catch every little virus. And woe to the Windows user who runs his PC unprotected.

The most popular new attack vector: Infected web pages, and not just gambling and porn sites. Everyday, mainstream sites are being compromised with malware booby traps via security holes in their web server software -- as the BBC notes, at a rate of one page every four seconds.

Alas, things aren't going to get much better in 2009. Today reports have arrived that SSL, the security system that protects e-commerce transactions (along with your credit card number) has been compromised. It's a minimal risk for now... but that's what they say about every attack method the first time it's discovered.