Researchers warn that the usage of the discontinued Boa web server is opening up SDKs and Internet of Things devices to attack.