University of Washington DNA Sequencing Security Study | University of Washington

Frequently-Asked Questions (FAQ)
Computer Security and Privacy in DNA Sequencing
Paul G. Allen School of Computer Science & Engineering, University of Washington

tl;dr → it’s a bug report on fqzcomp, fzcomp-4.6, wrapped in some lab work, wrapped in scare piece wrapped in an academic paper. It mentions DNA, people are made of DNA, YOU are made of DNA.

  • In the future, everyone will be famous for fifteen minutes.
    • They did it for the lulz, and the whuffie.
    • They did it for the FUD.
  • They are frontrunning the presntation of the paper at the conference site in Vancouver, CA
  • But there is nothing to worry about.
    • Really.
    • No, Really.
    • And they’ve already contacted the project sponsors with their work product.
However

Today’s theoretical demonstrations are tomorrow’s practice.

Original Sources

Ney, Koscher, Organick, Creze, Kohno; Computer Security, Privacy, and DNA Sequencing: Compromising Computers with Synthesized DNA, Privacy Leaks, and More; In  Proceedings of the USENIX Security Symposium; 2017-08-16; 15 pages.

Concept

  • They created DNA with particular patterns.
  • They used buffer overflows in C & C++ programs.
  • FASTQ, a data format.
  • /dev/tcp accessed via bash

Quotes

  • <quote>Although used broadly by biology researchers, many of these programs are written by small research groups and thus have likely not been subjected to serious adversarial pressure. </quote>
  • <quote><snip/> copied fqzcomp from SourceForge and inserted a vulnerability into version 4.6 of its source code; a function that processes and compresses DNA reads individually, using a fixed-size buffer to store the compressed data.<quote>
  • <quote>Our second exploit attempt uses an obscure feature of bash, which exposes virtual /dev/tcp devices that create TCP/IP connections. We use this feature to redirect stdin and stdout of /bin/sh to a TCP/IP socket, which connects back to our server.<quote>

Moral

The “research” coders do not validate their inputs; they use whatever computer tools are handy for their purpose. Their purpose is to publish papers in their field of study. Their code works just well enough; it is MVP for an MPU. Those “researchers” who do validate their inputs, who do test their code, who do read CVE notices, who do remediate latent vulnerabilities aren’t researchers at all. They are drone coders in an on-time-under-budget, time & materials IT shop. “We” need such people and such skill is a valued trade craft by which to make an honorable living.  But such activity is Not New. It is not The Research.

Comments are closed.