Researchers use DNA to infect a computer with malicious code

Malware-laden DNA strands can be used to exploit open-source software

A team of researchers have successfully infected a computer system using a strand of human DNA encoded with a malicious program.

The remarkable experiment, conducted by a multidisciplinary team of biologists and cyber security researchers at the University of Washington, aimed to address concerns around vulnerabilities in open-source software installed in labs around the world.

While vulnerabilities of this kind are typically targeted by malware and remote hacking, the team investigated the possibility that future attack vectors may emerged from the very materials being handled, in this case DNA being transcribed and digitised for further analysis.

Computers are required to handle the vast amount of processing needed to sift through the billions of DNA bases from a single sample. In order to store the basic units that make up DNA, the data is processed using multiple open-source computer programs.

"We analyzed open-source bioinformatics tools that are commonly used by researchers to analyze DNA data," the team explained in a research blog. "Many of these are written in languages like C and C++ that are known to contain security vulnerabilities unless programs are carefully written."

The team, based at the University of Washington's Paul G. Allen School of Computer Science and Engineering, identified that most of these programs do not follow best security practices, had little to no input sanitisation to check incoming code, and had a number of insecure functions.

Using a synthetic DNA strand with a malicious code embedded into its base, the team was able to demonstrate that standard code could be transferred during the transcription process. When the strand was sequenced, the code was able to exploit these vulnerabilities to take control of a system and in theory grant remote control to a hacker.

Given the unexpected nature of an attack of this kind, relatively basic remote execution malwares could prove to be highly effective. However, while the idea of human DNA being a route for hackers to spread malware is terrifying, the researchers said there is no evidence to suggests that the security around DNA sequencing is under attack, and that the goal of the research was to create awareness.

"We again stress that there is no cause for people to be alarmed today," the team added, "But we also encourage the DNA sequencing community to proactively address computer security risks before any adversaries manifest. That said, it is time to improve the state of DNA security."

However, it does highlight the need for security researchers to be one step ahead of criminals, and keep track of emerging technology before it can be exploited.

The team is due to present its findings at the USENIX Security Symposium in Vancouver next week.

Picture: Bigstock

Featured Resources

Five lessons learned from the pivot to a distributed workforce

Delivering continuity and scale with a remote work strategy

Download now

Connected experiences in a digital transformation

Enable businesses to meet the demands of the future

Download now

Simplify to secure

Reduce complexity by integrating your security ecosystem

Download now

Enhance the safety and security of your people, assets and operations

Enable a true vision of security with an engineered solution based on hyperconverged and storage platforms

Download now

Recommended

'Largest ever' Magecart hack compromises 2,000 online stores
hacking

'Largest ever' Magecart hack compromises 2,000 online stores

15 Sep 2020
'NetWalker' ransomware explodes thanks to 'as a service' expansion
ransomware

'NetWalker' ransomware explodes thanks to 'as a service' expansion

4 Sep 2020
Infocyte integrates with Palo Alto Networks Cortex XSOAR
cyber security

Infocyte integrates with Palo Alto Networks Cortex XSOAR

19 Aug 2020
Malware attacks using machine identities doubled in 2019
cyber security

Malware attacks using machine identities doubled in 2019

4 Aug 2020

Most Popular

Accenture ploughs $3 billion into cloud migration support group
digital transformation

Accenture ploughs $3 billion into cloud migration support group

17 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Google Pixel 4a review: A picture-perfect package
Google Android

Google Pixel 4a review: A picture-perfect package

18 Sep 2020