Stories
Slash Boxes
Comments

SoylentNews is people

posted by Fnord666 on Friday August 11 2017, @03:21AM   Printer-friendly
from the gives-fireeye-a-whole-new-meaning dept.

Research to be presented at the 2017 USENIX Security Symposium has shown how DNA sequencing software can theoretically be hacked using malware embedded into synthesized DNA:

Researchers at the University of Washington have shown that by changing a little bit of computer code they can insert malware into a strand of DNA that, when read by DNA sequencing software, allows them to remotely control a computer or cause it to suddenly crash.

In a related analysis, the group evaluated the security of 13 software programs commonly used for DNA analysis, and found 11 times as many vulnerabilities as are present in other types of software.

The "hack" required the team to add a buffer overflow vulnerability into the open source program fqzcomp, so it doesn't reflect a real world risk. But there may be other issues at labs:

Anyone who creates an account at DNA research institutes could also submit sequencing files that could be malicious. Additionally, since bioinformatics software isn't commonly targeted by hackers, the software isn't generally hardened to attacks. They also note patching difficulties since DNA analysis software packages are often aren't[sic] managed in a central code repository.

Quick, let's edit our genomes to add malware!

This research came too late to be used in a CSI script.

Computer Security, Privacy, and DNA Sequencing: Compromising Computers with Synthesized DNA, Privacy Leaks, and More


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by takyon on Friday August 11 2017, @05:58AM (2 children)

    by takyon (881) <reversethis-{gro ... s} {ta} {noykat}> on Friday August 11 2017, @05:58AM (#552151) Journal

    And yet they still had to gene code edit a vuln in. Sad (I want hack)!

    --
    [SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 0) by Anonymous Coward on Friday August 11 2017, @06:18AM (1 child)

    by Anonymous Coward on Friday August 11 2017, @06:18AM (#552158)

    Maybe... but this research gives something to think about.

    DNA contains 4 possible nucleotides + some other "options", which allow encoding it into one byte/nucleotide. If these bytes get written beyond their buffer, they could potentially be reinterpreted by the computer as executional code, hence allowing the DNA code to be executed as a program. But in principle, this could be done with any data that's being read, it's just that they found a novel attack vector that could be used in multiple ways. Thing is that DNA sequencing is often outsourced to third party companies, requiring some trust between the parties (that you don't send them DNA-encoded malware and they don't return sequencing data with hacked sequences).

    • (Score: 2) by takyon on Friday August 11 2017, @06:42AM

      by takyon (881) <reversethis-{gro ... s} {ta} {noykat}> on Friday August 11 2017, @06:42AM (#552165) Journal

      It remains to be seen if this attack vector ever becomes useful. Now they've clued in the world to this possibility. Hacking a facility that routinely sequences DNA could yield very valuable data (intellectual property or "useful" genes, genomes for "high value" people, etc.)

      Bioengineering is a big deal and for some firms a loss of secret IP could lead to nearly immediate bankruptcy.

      --
      [SIG] 10/28/2017: Soylent Upgrade v14 [soylentnews.org]