Protecting users, corporations, and government agencies is one of the priorities of computer security as a whole, but that is just the tip of the iceberg. There are much more critical environments that could cause great damage if breached, and a group of researchers at the University of Washington demonstrated it in a very particular way: encoding malware in a DNA sample, which can attack the sequencer and take control of the computer in the background.
Imagine a future in which a DNA sample is dangerous not from a biological point of view, but from a digital one. In the past we have seen examples of DNA as a storage medium, and with a density of 215 petabytes per gram, it could become a definitive solution among cold backups and WORM platforms. However, turning DNA into a "hard drive" is a slow and expensive process, two conditions that the market naturally rejects. It is likely that the technology needs several years of development to optimize both points, but there is another aspect to consider, and that is security. After all, if an infected USB drive can take control of a computer, what prevents DNA from doing the same...?
The proof of concept
According to a team of researchers at the University of Washington, the answer is nothing… as long as the attacker is up to the task. In relaxed terms, their work focused on encoding a buffer overflow exploit in a DNA sample with a length of 176 bases (2 bits per base, 44 bytes in total), but the "relaxation" ends there. The task was much more complex and advanced than they initially imagined, because in addition to preserving code integrity, they also obeyed certain physical constraints in DNA. Its stability requires an appropriate ratio of A-T and G-C pairs, so the code had to be adapted to its "container", so to speak.
Limitations and implications
Now, the project has two asterisks that we cannot ignore. First, only 37.4 percent of the reads presented a functional code sample, so the malware does not have redundancies or resistance to sequencing errors. Second, their proof of concept required the creation of a vulnerability in the open source software (fqzcomp), something that could be interpreted as "cheating". Still, the researchers were able to confirm that security risks exist, even if they are very long-term. If DNA sequencing gains traction and becomes domestic, we might need additional protections.
