Synopsys, a company that provides tools and services for designing chips and electronic systems, said on Monday that it would acquire Cigital, a provider of software security testing solutions, along with Cigital spin-off Codiscope, which also provides security tools. 

Cigital is a privately held application security firm the specializes in professional and managed services to help customers identify, fix and prevent vulnerabilities in software. 

Codiscope was established as a spin-off of Cigital in 2015, and has has “transformed the tools and intellectual property created by Cigital into a suite of accessible and streamlined tools for a broad population of developers.”

The terms of the deal were not disclosed. In 2014, Synopsys, acquired Coverity, a provider of software quality, testing, and security tools for roughly $375 million.

Cigital was established in 1992 with funding and contracts from DARPA and NASA. In October 2013, the company received a $50 million equity investment from private equity firm LLR Partners.

Cigital is also a driving force behind BSIMM (Building Security In Maturity Model), a study of real-world software security initiatives designed to serve as a measuring stick for secure application development programs.

“The acquisition of Cigital and Codiscope will add complementary products, services, and a highly skilled workforce to the Synopsys portfolio, enabling Synopsys to offer a comprehensive software security signoff solution,” Synopsys explained in the annoucement.

"Synopsys, Cigital and Codiscope have a shared vision of building security into the software development lifecycle and across the cyber supply chain," said Andreas Kuehlmann, senior vice president and general manager of the Synopsys Software Integrity Group. 

Jim Ivers, CMO at Cigital, is a SecurityWeek columnist. 

For more than 10 years, Mike Lennon has been closely monitoring and analyzing trends in the enterprise IT security space and the threat landscape. In his role at SecurityWeek he oversees the editorial direction of the publication and manages several leading security conferences.

Previous Columns by Mike Lennon:

Tags:

Trustwave has disclosed an unpatched remote code execution (RCE) vulnerability affecting Bopup Communication Server, a solution that allows enterprises to manage and control their IM communications.

The flaw, discovered by Trustwave researcher Neil Kettle, is a buffer overflow related to how packets sent to the remote administration port on 19809/TCP, one of the two ports used by Bopup Communications Server, are handled and parsed prior to authentication. The security hole can be exploited by sending specially crafted packets to the application.

“Through this, an attacker can execute arbitrary code on the remote host with the privileges of the Bopup Communications Server, namely SYSTEM. The issue occurs due to a lack of bounds validation in several calls to memcpy with user-definable lengths with the destination buffer allocated on the stack,” Trustwave said in its advisory.

Kettle discovered the vulnerability while trying to reverse engineer Bopup Communication Server and the protocol it uses. Trustwave’s advisory includes proof-of-concept (PoC) code that can be used to exploit the flaw.

Trustwave said the vulnerability affects Bopup Communication Server version 4.5.3.13001 and earlier. B-Labs was notified about the issue in mid-July, but the vendor has been unresponsive and the flaw remains unpatched. SecurityWeek has reached out to B-Labs for comment and will update this article if the company responds.

Until a patch becomes available, Bopup Communication Server users can protect themselves against potential attacks by using intrusion prevention and intrusion detection systems, Trustwave said.

Related Reading: Researchers Claim Wickr Patched Flaws but Didn't Pay Rewards

Related Reading: Flaw Allows Hackers to Alter "Signal" Attachments

Related Reading: Attackers Can Target Enterprises via GroupWise Collaboration Tool

Previous Columns by Eduard Kovacs:

Tags:

A researcher has discovered a couple of critical and medium severity vulnerabilities affecting various industrial ethernet products from Taiwan-based industrial networking, computing and automation solutions provider Moxa.

According to an advisory published recently by ICS-CERT, Moxa’s OnCell industrial LTE cellular gateways, AWK wireless AP/bridge/client products, WAC wireless access controllers, and TAP railway wireless units have improper authentication and OS command execution vulnerabilities. The issues were reported to Moxa, through ICS-CERT, by researcher Maxim Rupp.

The more serious of the issues, tracked as CVE-2016-8363 and assigned a CVSS score of 9.1, allows a malicious user to execute arbitrary OS commands on the affected server.

Rupp told SecurityWeek that the impacted products include a function designed for identifying other devices on the network. An authenticated attacker can abuse this functionality via a specific system operator followed by any OS command. The expert believes the vendor did not expect this functionality to be abused in such a manner.

The second flaw, identified as CVE-2016-8362, allows a user to download log files by accessing specific URLs.

The flaws can be exploited remotely even by an attacker with low skill and Rupp warned that there are more than 100 vulnerable devices accessible from the Internet.

Firmware updates that patch these vulnerabilities were released by Moxa on November 1 for OnCell G3470A-LTE and AWK-1131A/3131A/4131A products. Firmware updates for some of the other devices are expected to become available in May and June 2017. Moxa has informed customers that some AWK products and the affected TAP device model are no longer supported and will not receive any updates.

Rupp has identified more than a dozen vulnerabilities in Moxa products over the past months, including in routers, serial device servers and cellular IP gateways. Others identified serious flaws in Moxa’s factory automation products and MiiNePort embedded serial-to-Ethernet device server modules.

Related Reading: ICS Networks at Risk Due to Flaw in Schneider PLC Simulator

Related Reading: Flaw in Schneider Industrial Firewalls Allows Remote Code Execution

Previous Columns by Eduard Kovacs:

Tags:

Cisco last week prompted a password reset for the user accounts on its Cisco Professional Careers mobile website after a security researcher discovered a vulnerability in the portal.

The networking giant decided to reset the user passwords to ensure that accounts are kept secure, and says that the issue would have resulted in exposing “a limited set of job application-related information.” Cisco says that it doesn’t believe that the exposed information was accessed by anyone else than the researcher who discovered the security flaw.

The issue, Cisco said, was the result of an incorrect security setting following system maintenance on a third party website. As soon as it became aware of the issue, the company corrected the setting and prompted the user password reset on the website.

The flaw was discovered by an independent security researcher, and a combined investigation in the matter revealed that the incorrect settings were in place twice: from August 2015 to September 2015, and from July 2016 to August 2016.

In the breach notification to users, the company revealed that exposed data included the user name, address, email, phone number, username and password, answers to security questions, education and professional profile, cover letter and resume text, and voluntary information, where available (gender, race, veteran status, and disability).

The company says that only the researcher who discovered the bug is believed to have had access to the exposed information, but it did tell users that an instance of unexplained, anomalous connection to the server determined it to take precautionary measures.

On November 2, the company decided to alert its users on the matter, prompting them to reset their passwords upon their next login to the mobile Professional Careers website by clicking “Forgot My Password.” On top of that, the company has decided to disable access to the site using security questions.

“We recommend that affected users take precautionary steps noted below to protect their identity. Cisco takes its responsibility to protect information seriously. We apologize for any inconvenience this incident may cause,” the company said.

According to Cisco, users receiving the warning email should reset their passwords on other websites as well, especially if they tend to use the same password on multiple websites. In fact, the company says, they should update their login credentials, passwords, and security questions and answers for any other websites on which they use the same credentials and information as the Cisco Professional Careers mobile website.

In the meantime, Cisco continues to investigate and monitor the incident, while also taking steps to mitigate such incidents from occurring in the future. The company also says that it will update the exposed information as soon as additional details emerge.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

Microsoft has announced that it will retire the Enhanced Mitigation Experience Toolkit (EMET) 18 months later than initially planned.

Designed to help prevent the exploitation of vulnerabilities in software, EMET was initially released in 2009, when the 3-4 year gap between major Windows releases prompted the launch of a solution to deliver mitigation against certain zero-day software vulnerabilities. Seven years later, Microsoft feels that EMET is no longer fitted for the job and says that Windows 10 can do a better job at protecting users.

The company initially said it would retire EMET on Jan. 27, 2017, but customer feedback determined it to push that end-of-life date back 18 months, to July 31, 2018. After that date, however, no security patches will be released for the utility.

“There are no plans to offer support or security patching for EMET after July 31, 2018. For improved security, our recommendation is for customers to migrate to Windows 10,” Jeffrey Sutherland, Principal Lead Program Manager within Microsoft Operating System Group’s OS Security, explains.

In February 2016, Microsoft released EMET 5.5 with Windows 10 compatibility and a variety of other enhancements, but also pointed out that the security features in Windows 10 make EMET unnecessary.

Over time, EMET helped the tech giant disrupt common exploit kits employed by attackers, and keep customers safe without a new Windows release. Additionally, Microsoft says, EMET helped assess new security features, which led to innovations in Windows 7, 8, 8.1, and 10.

The main issue of the enterprise utility, however, is the fact that it hasn’t been yet integrated into the operating system, meaning that it has limits. Its features weren’t designed as robust security solutions and can’t offer real durable protection against exploits over time. In fact, Microsoft says, trivial bypasses are readily available online to circumvent EMET.

“To accomplish its tasks, EMET hooks into low-level areas of the operating system in ways they weren’t originally designed. This has caused serious side-effects in both performance and reliability of the system and the applications running on it. And this presents an ongoing problem for customers since every OS or application update can trigger performance and reliability issues due to incompatibility with EMET,” Sutherland continues.

Another major issue of EMET, he says, is that it hasn’t kept pace with the evolving operating system beneath it. Thus, EMET 5.5x hasn’t yet been deemed effective against modern exploit kits compared to the many security innovations built-in to Windows 10.

With customers requesting the inclusion of EMET-like security protection, Microsoft decided to do exactly that starting with Windows 10, when they moved to Windows as a Service. The operating system packs features such as Device Guard, Credential Guard, and Windows Defender Application Guard in Microsoft Edge, Windows Defender Advanced Threat Protection (ATP), and options such as DEP, ASLR, and Control Flow Guard (CFG), along with mitigations to prevent bypasses in UAC, with make EMET unnecessary.

Related: Windows Information Protection to Address Data Leaks in Windows 10

Related: Microsoft EMET Adds Windows 10 Compatibility

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

Tesco Bank, wholly owned by the UK's largest supermarket chain Tesco, has admitted the "some of its customers' current accounts have been subject to online criminal activity, in some cases resulting in money being withdrawn fraudulently." Nothing more specific about the fraud has been made known, although some reports suggest as many as 20,000 customers may have lost money.

Benny Higgins, the bank's chief executive, said 40,000 of current accounts had experienced suspicious transactions and about half had money taken from their account. Tesco Bank has now blocked all on-line transactions, although customers can still use their bank card for cash withdrawals and purchases within shops. The bank has just under 8 million customers and around $10 billion in saving deposits. The thefts were from among its 136,000 current accounts.

Higgins believes that relatively small amounts will have been stolen from individual accounts, but that the details are not yet clear. Small amounts would be compatible with attempts to avoid triggering the bank's fraud detection alerts; but with 20,000 successful withdrawals and another 20,000 potentially blocked, the indication is that the criminals operated very quickly to steal as much as possible before the bank blocked all online transactions. They also timed their activity for a weekend, when fewer bank staff would be working.

Customers are reporting on social media individual thefts of £600 and £700. One report quotes a customer complaint: "Spoke to Tesco after 1 hour 20 minutes on hold, like others, just waiting for a call back and no sign of my £2,400 today. I'm taking the day off work, I can't go in feeling as low as this."

The bank has stressed that all stolen money will be refunded to customers. "Any financial loss that results from this fraudulent activity will be borne by the bank," Higgins told BBC radio. "Customers are not at financial risk." He believes the cost to the bank will be 'a big number but not a huge number'.

Customers are, however, far from happy with Tesco's customer support. Although the bank has reacted swiftly to block any further losses, customers are finding it difficult to learn anything individually. Many have taken to social media complaining about receiving texts urging them to phone a customer support number only to remain on hold for hours at a time. It would seem that Tesco's incident response plans for minimizing loss were better prepared than its incident response for customer care.

"We are now in dialogue with the National Crime Agency. We are working closely with them. We are also in close contact with the Financial Conduct Authority," Higgins told BBC Radio. The bank will also be in touch with the UK's data protection regulator, the Information Commissioner's Office (ICO). The ICO will investigate whether it thinks Tesco's internal security was adequate. It recently fined TalkTalk £400,000 for failing to adequately protect its customers' personal data.

For now, nothing is publicly known about how the breach was effected. Ilia Kolochenko, CEO and founder of High-Tech Bridge, commented: "The situation is not clear yet, and it's too early to make any conclusions about the origins and the source of the breach. In the past, similar incidents involved many different approaches: from e-banking system compromise to targeted spear-phishing and social engineering campaigns aimed at infecting bank clients' machines or mobile devices with sophisticated malware, stealing money from their accounts. A massive skimming campaign cannot be excluded either."

He does not believe that an actual hack could be achieved without some inside help. "Banking system, compliance processes and fraud-prevention systems are usually bank-specific, and in order to bypass them (we can speak about successful bypass, as so many people have already lost their money) there would need to have some insider knowledge."

Ed Macnair, CEO of CensorNet, takes a similar view, although he thinks the 'inside help' could be accidental. "People are the weakest link for most organizations," he said, "and I would not be at all surprised if that's the case here. It's pretty hard to remotely hack into a network without some sort of assistance - which is often provided accidentally. People tend to do stupid things, like reusing passwords or clicking on random links, giving hackers the access they need."

It is believed that this is the first acknowledged hack of a British bank leading to large scale losses. Tesco shares fell by 1.28% to 199.90 pence on the news, while London shares generally rose 1.3%.

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags: