Still using a discontinued Boa web server? Microsoft warns of supply chain attacks

guest · Nov 23, 2022

Flaws in the open-source tool exploited – and India's power grid was a target
By Jeff Burt @jburttech - November 23, 2022

Microsoft is warning that systems using the long-discontinued Boa web server could be at risk of attacks after a series of intrusion attempts of power grid operations in India likely included exploiting security flaws in the technology.
Click to expand...

Researchers with Microsoft's Security Threat Intelligence unit examined an April report from cybersecurity company Recorded Future about the intrusion efforts into India's power grid dating back to 2020 and, more recently, into a national emergency response system and a global logistics company's Indian subsidiary.
Click to expand...

The Microsoft researchers, digging into the report, detected a vulnerable component – the Boa web server – on the IP addresses listed as indicators of compromise (IOC). They wrote in their own analysis this week that they "found evidence of a supply chain risk that may affect millions of organizations and devices."

"Microsoft continues to see attackers attempting to exploit Boa vulnerabilities beyond the timeframe of the released report, indicating that it is still targeted as an attack vector," the analysts wrote.

"The popularity of the Boa web server displays the potential exposure risk of an insecure supply chain, even when security best practices are applied to devices in the network," the researchers wrote. "Updating the firmware of IoT devices does not always patch SDKs or specific [SoC] components and there is limited visibility into components and whether they can be updated."
Click to expand...

Microsoft: Vulnerable SDK components lead to supply chain risks in IoT and OT environments

November 22, 2022
We assessed the vulnerable component to be the Boa web server, which is often used to access settings and management consoles and sign-in screens in devices. Despite being discontinued in 2005, the Boa web server continues to be implemented by different vendors across a variety of IoT devices and popular software development kits (SDKs).

Without developers managing the Boa web server, its known vulnerabilities could allow attackers to silently gain access to networks by collecting information from files. Moreover, those affected may be unaware that their devices run services using the discontinued Boa web server, and that firmware updates and downstream patches do not address its known vulnerabilities.
Click to expand...

Log in or Sign up

Still using a discontinued Boa web server? Microsoft warns of supply chain attacks

guest Guest

Log in or Sign up

Still using a discontinued Boa web server? Microsoft warns of supply chain attacks

guest Guest

Useful Searches