Microsoft released a statement on Tuesday, claiming that its Boa server remains vulnerable in the wake of cybercriminals targeting India's energy infrastructure wherein Boa's vulnerabilities were exploited.
In 2005, Boa servers were discontinued. Even then, Boa servers are used in software development kits (SDKs), routers, and security cameras. When servers are discontinued, they stop receiving regular security updates to patch vulnerabilities. In the absence of the same, cybercriminals have been actively exploiting Boa.
These vulnerabilities were acknowledged by Microsoft for the first time on Tuesday. According to Microsoft, state-sponsored cybercriminals in China hacked into internet-of-things (IoT) devices that regulate India's power infrastructure.
The most recent cyberattack shook Tata Power in October. Hive ransomware group took credit for the same, claiming to have posted the data they stole from Tata Power. The stolen information included Tata Power employees' personal credentials, Aadhar card details, PAN account number, salary information, and more.
In the report titled, "Vulnerable SDK components lead to supply chain risks in IoT and OT environments," Microsoft outlines Boa server vulnerabilities, suspicious IP addresses, and vulnerable SDKs.
Also read:?Microsoft Finds 'Raspberry Robin' Worm On Windows Networks: How Does It Spread?
Microsoft Defender Threat Intelligence platform was able to identify over a million exposed Boa server components around the world - most of which are situated in India, South Korea, and Taiwan. Cybercriminals exploit various vulnerabilities to take control of critical operations.
A cybersecurity company called Recorded Future earlier provided evidence of Chinese state-backed cyberattacks against Indian power grid. These hackers attacked State Load Despatch Centres (SLDCs) that are responsible for controlling the grid and maintaining electricity dispatch operations. In essence, SLDCs maintain grid stability.
While official investigations haven't confirmed Chinese involvement, Tata Power seems to have been a victim of the Microsoft Boa server vulnerability. Tata was hit by cyberattacks in late 2021, and continues to be hurt by the same till now. Most of these affected North India.
Also read:?Microsoft To Retire Facial Recognition Tool That Identified People's Emotions
Recorded Future claims that Microsoft Boa isn't the only vulnerability used by cybercriminals to target Indian energy infrastructure.
"In addition to the targeting of power grid assets, we also identified the compromise of a national emergency response system and the Indian subsidiary of a multinational logistics company by the same threat activity group... To achieve this, the group likely compromised and co-opted internet-facing DVR/IP camera devices for command and control (C2) of Shadowpad malware infections, as well as use of the open source tool FastReverseProxy," the company wrote.
What do you think about this threat faced by modern companies? Let us know in the comments below.?For more in the world of?technology?and?science, keep reading?Indiatimes.com.?
References
McCafferty, K. (2022, November 22). Vulnerable SDK components lead to supply chain risks in IoT and OT environments. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/
Keeffe, D. O. (2022, November 24). Cybercriminals Exploit Microsoft Boa Server, Target Indian Power Grid. TechGenix. https://techgenix.com/cybercriminals-exploit-microsoft-boa-server-targeting-indian-power-grid/
Sharma, A. (2022, October 25). Hive claims ransomware attack on Tata Power, begins leaking data. BleepingComputer. https://www.bleepingcomputer.com/news/security/hive-claims-ransomware-attack-on-tata-power-begins-leaking-data/