Hackers Exploiting Abandoned Boa Web Servers to Target Critical Industries

Microsoft on Tuesday disclosed the intrusion activity aimed at
Indian power grid entities earlier this year likely involved the
exploitation of security flaws in a now-discontinued web server
called Boa.

The tech behemoth’s cybersecurity division said^[1]
the vulnerable component poses a “supply chain risk that may affect
millions of organizations and devices.”

The findings build on a prior report published^[2]
by Recorded Future in April 2022, which delved into a sustained
campaign orchestrated by suspected China-linked adversaries to
strike critical infrastructure organizations in India.

The cybersecurity firm attributed the attacks to a previously
undocumented threat cluster called Threat Activity Group 38. While
the Indian government described the attack as unsuccessful “probing
attempts,” China denied it was behind the campaign.

The connections to China stem from the use of a modular backdoor
dubbed ShadowPad^[3], which is known to be
shared among several espionage groups that conduct
intelligence-gathering missions on behalf of the nation.

Although the exact initial infection vector used to breach the
networks remains unknown, the ShadowPad implant was controlled by
using a network of compromised internet-facing DVR/IP camera
devices.

Microsoft said its own investigation into the attack activity
uncovered Boa as a common link, assessing that the intrusions were
directed against exposed IoT devices running the web server.

“Despite being discontinued in 2005, the Boa web server
continues to be implemented by different vendors across a variety
of IoT devices and popular software development kits (SDKs),” the
company said.

“Without developers managing the Boa web server, its known
vulnerabilities could allow attackers to silently gain access to
networks by collecting information from files.”

The latest findings once again underscore the supply chain risk
arising out of flaws in widely-used network components, which could
expose critical infrastructure to breaches via publicly-accessible
devices running the vulnerable web server.

Microsoft further said it detected more than one million
internet-exposed Boa server components worldwide in a single week,
with significant concentrations in India.

The pervasive nature of Boa servers is attributed to the fact
that they are integrated into widely-used SDKs, such as those from
RealTek, which are then bundled with devices like routers, access
points, and repeaters.

The complex nature of the software supply chain^[4]
means that fixes from an upstream vendor may not trickle down to
customers and that unresolved flaws could continue to persist
despite firmware updates from downstream manufacturers.

Some of the high-severity bugs affecting Boa include CVE-2017-9833^[5]
and CVE-2021-33558^[6], which, if successfully
exploited, could enable malicious hacking groups to read arbitrary
files, obtain sensitive information, and achieve remote code
execution.

Weaponizing these unpatched shortcomings could further enable
threat actors to glean more information about the targeted IT
environments, effectively making way for disruptive attacks.

“The popularity of the Boa web server displays the potential
exposure risk of an insecure supply chain, even when security best
practices are applied to devices in the network,” Microsoft
said.

“As attackers seek new footholds into increasingly secure
devices and networks, identifying and preventing distributed
security risks through software and hardware supply chains, like
outdated components, should be prioritized by organizations.”