Cyberattack Could Trick Scientists Into Producing Dangerous Toxins or Viruses

SciTech Daily recently reported, an "end-to-end cyber-biological attack" in which unaware biologists may be deceived into producing hazardous toxins in their laboratories has been discovered by cyber-researchers from Ben-Gurion University of the Negev cyber-researchers.

According to a study recently published in Nature Biotechnology, it is presently understood that a criminal need to have physical contact with a dangerous element to generate and have it delivered.

Nevertheless, the said report specified that malware could simply replace "a short sub-string of the DNA on the computer of a bioengineer" in order for them to create a toxin that produces sequence intentionally.

Dangerous Substances

BGU Complex Networks Analysis Lab head, Rami Puzis, who's also a Department of Software and Information Systems Engineering and Cyber@BGU member said, to control "both intentional and unintentional generation of dangerous substances," most providers of synthetic genes screen DNA orders, which is presently the most efficient line of defense against certain attacks.

In relation to this, California was reported as a pioneering state this year to present gene purchase regulation legislation.

Nonetheless, outside the state, Puzis added, bioterrorists can purchase hazardous DNA from firms that are not screening the orders.

Unfortunately, the lab head elaborated, the guidelines for screening have not been adjusted to redirect or mirror recent developments in cyberwarfare and synthetic biology.

Screening Protocols

A weakness in the United States Department of Health and Human Services (HHS) guidance for DNA providers enables protocols for screening to be evaded or avoided through the use of a generic obfuscation procedure, making it much more difficult for the screening software to identify DNA that produces the toxin.

According to Puzis, using such an approach, their experiments found that out of 50 obfuscated DNA samples, 16 were not identified when screened, based on the "base-match HHS guidelines."

The study authors found, too, that the synthetic gene engineering workflow's accessibility and automation, combined with inadequate cybersecurity controls, enable malware to inhibit or impede the biological processes within the laboratory of the victim, closing the loop with the probability of an exploit written into a DNA molecule.

Danger of a Malicious Code

Also indicated in the SciTech Daily report, the DNA injection attack is exhibiting a substantial new danger of malicious code changing biological procedures.

Even though simpler attacks that may damage biological experiments are available, the study investigators have opted to present a scenario that utilizes multiple weaknesses at three bioengineering workflow levels that comprise software, biosecurity screening, and biological protocols.

This particular scenario underscores the opportunities of applying the 'know-how' of cybersecurity in new contexts like biosecurity and gene coding.

Puzis also explained, the attack scenario highlights the necessity to harden the supply chain of synthetic DNA with protections from cyber-biological threats.

To deal with such threats, the researchers suggest that an enhanced screening algorithm, "taking into account in vivo gene editing."

Specifically, they said, they are hoping this study sets the stage for strong, adversary "resilient DNA sequence screening," as well as cybersecurity-hardening synthetic gene production services when there will be an enforcement of biosecurity screening by local regulations around the world.

Check out more news and information on Cyber Attack on Science Times.