IoT/OT/ICS threats: Detecting vulnerable Boa web servers

Editor's note: This blog post was updated on 12/1/22 to add the "Update 12/1/22" and corresponding paragraph added to the end of the blog post.

On Nov. 22, 2022 Microsoft announced research findings about an ongoing supply chain attack against IoT devices running Boa web servers. The Boa web server, an open-source small-footprint web server suitable for embedded applications, was discontinued in 2005, but many software development kits still use this lightweight server on IoT hardware. Since being discontinued, vulnerabilities were discovered in Boa that make every version out there exploitable. Users may not even be aware they are running a  vulnerable Boa web server on IoT devices they own.

Corelight Labs downloaded and installed the last version of Boa in a lab environment and observed the following string returned in the HTTP server header:

Boa/0.94.14rc21

The string above can be detected in the HTTP server header when someone visits a Boa server on your network using this simple Zeek code block:

The resulting notices are:

Corelight Labs released a Zeek package with the code above so you can quickly begin to identify which machines are running a vulnerable Boa web server if someone connects to it on your network today. This package will help check off the “utilize device discovery and classification” remediation recommendation in Microsoft’s research findings.


Note that if you installed the following open source package, all HTTP headers will be logged to http.log:


https://github.com/sethhall/zeek-log-all-http-headers

Once this package is enabled, the following LogScale (formerly known as Humio) query will pull the devices reporting as Boa web servers on your network too:

#path=http | concatArray(server_header_values,as=headers)| headers=/Boa\/0/

Update 12/1/22

Since publishing this blog we discovered two additional methods for detecting vulnerable Boa web servers.  If you have included your networks in Sites::local_nets, Zeek’s software.log will contain web server versions of devices in those networks.  You can search unparsed_version for Boa vulnerable web servers with the following LogScale query:

#path=software unparsed_version=/Boa\//

If you are running Corelight sensors and enabled the Entity package, you can also search the known_services.log software column with the following LogScale query:

#path=known_services software=/Boa\//

By Corelight Labs Team