Malware DNA: A New Frontier in Identifying and Preventing Cyberattacks?

Malware DNA is a new malicious program in which the malware code is engineered or encoded into biological DNA strands. This concept shows how biological material can become a new carrier of malicious codes to launch complex cyber attacks. A research team at the University of Washington (UW) created a malware DNA program in the lab by converting the digital malware into a DNA sequence. The experiment was just a proof-of-concept by the researchers to show how digital and biological systems can merge together and launch a whole new scope of cyber threats using biological elements. It shows how new dangers are lurking in this ever-evolving world of technology. This write-up offers a detailed description of malware DNA and how it poses a new challenge for cybersecurity.

Malware DNA

How is Malware DNA Strand Created?

Researchers took a small piece of malware and converted it into DNA code (A, T, C, G). They started with a simple buffer overflow exploit, which is a security vulnerability that takes place when a program adds more data to a memory buffer than it can hold. When too much data is stuffed in it, the extra data spills over and corrupts the nearby or adjacent memory.
A buffer overflow exploit involves a binary number directly or as a part of a compiled program. It is a common representation because all executable codes on computers are ultimately represented in binary (0s and 1s). Researchers converted this binary code into a DNA sequence by mapping each pair of binary to one of the four DNA bases A, C, G, T. This way, every 2 bits of binary were turned into one DNA letter, for example: 001011 → A (00), G (10), T (11).
DNA synthesis and sequencing have physical limitations that can lead to errors. To prevent these errors, researchers used error-correction algorithms and encoding filters to keep the DNA sequence chemically stable and readable. After this, they send the final DNA code to a DNA synthesis lab. The lab chemically synthesized the strand, just like ordering synthetic DNA for gene editing.
Once the malware DNA strand was ready, they fed it to a DNA sequencer machine. The machine read the bases in the DNA and converted them back to text (A, C, G, T). When the DNA sequencing output was processed by bioinformatics software running on a vulnerable computer, the malicious sequence triggered a buffer overflow in the software and caused a malware code to execute on the system and infect it.

How can DNA Malware be a New Frontier in Cyberattacks?

Researchers conducting the experiment with the new DNA malware did it in controlled lab conditions. They created a vulnerability in the system on purpose to prove that biological material can carry and deliver bio-engineered malware in the software system running on a computer. They had no bad intention whatsoever to launch a cyberattack. But the successful experimentation with the malware code converting into a DNA strand and then delivering the payload to a system opened up a new frontier in cybersecurity. Real-world bioinformatics tools are at great risk if they are exposed to this type of real-world malware attack.

Even though it was just an experiment done to prove the proof of concept, it won’t take much longer to become a reality in the near future. If this technology becomes widespread and easily accessible, then it will unleash a whole new way for malicious codes to infect a computer system and compromise the sensitive data in digital systems in healthcare facilities. This breakthrough can shift the traditional cyber attack landscape from the digital domain to the bio-digital landscape.

Present cybersecurity systems that involve antivirus software, a firewall, and secure operating systems are built to identify and prevent cyberattacks coming from digital domains. If bio-engineered malware DNA strands enter in then the present security software won’t be able to handle them. This will open up a new frontier in cyberattacks backed by synthesized malware DNA sequences.

What will be the Main Targets of Malware DNA strands?

Biotech labs, hospitals, biotech companies, forensics, academic labs, and research facilities use different types of software to run their operations. These software can be affected badly and get compromised if it comes into contact with any malware DNA strands. Specifically, if malware DNA strands are fed to vulnerable sequencing or analysis software lacking basic security features, it can easily be taken over. Once this is done, the software inside the sequencing machine triggers buffer overflow attacks or other exploits that allow the attacker to gain control over the system.

If one system, for example, a vulnerable DNA sequencing software, gets infected with the malicious code, then it can spread from one system to another. The biotechnology laboratories will become potential entry points for cyber intrusions. These labs typically prioritize biological safety, not cybersecurity. Their tools are often open-source, outdated, or developed without digital security in mind.

DNA malware can physically arrive in the form of a mailed sample, planted contaminant, or routine test material. This makes it invisible to traditional digital security systems. The whole healthcare facility is exposed to risks of malware attacks. If one system in the facility is hijacked, then malware can spread to the other devices using the same network or using the single channel. The whole DNA databases, bioinformatics computers, and bio-research facilities can bear the brunt of malware. Firewalls, antivirus programs, and built–in security tools in a system won’t be able to identify and prevent this type of cyberattack.

What Threat Does Malware DNA Pose for People and Organizations?

Traditional malware uses files, emails, USB drives, networks, and malicious code to spread and infect a computer system. However, malware DNA can be encoded in biological material and physically spread through lab samples, biological containers, and contaminated tools. It breaks the boundary of both physical and digital security. Due to this, it can damage people and healthcare facilities and disrupt the operation in a completely new way.
For example, in a lab or supply chain scenario, an attacker can mail a tube of malicious DNA to a genomics lab. He can infect sequencing software to activate when the DNA is read by the software. In the aftermath, the attacker can easily steal results, control lab systems, or spread malware further to the other systems. If these systems are hacked using bio-malware, then the sensitive genomic data can be stolen, lab workflows can be crippled, R&D data can be exfiltrated, and the entire hospital or research networks could be sabotaged. With this widespread havoc, a new cycle of crime and chaos will result in the aftermath. For example:
  • Violation of patient privacy, HIPAA breaches
  • Corrupt reports, Misdiagnosis, or delayed treatment.
  • Malfunctioning malware-infected electronic health record (EHR) systems or diagnostic devices. 
  • Ransomware Attack to encrypt patient genetic data and ransom demand from hospitals.
  • Lab operations and medical diagnoses could be disrupted or manipulated
  • Millions of customers’ genetic profiles have been leaked or sold on the dark web.
  • Targeted manipulation psychologically attacks or manipulates individuals based on genetics.
  • Academic and University Research Labs can lose years of scientific research

Final Thoughts

As the technology evolves and different fields are merging with one another, it is highly important to ensure that the new tools and technologies are used for the betterment of humanity as a whole. Tech companies, government, and accountable authorities have to make sure these new technologies do not fall into the hands of bad actors. No one should be allowed to use the new technology to launch an offensive against innocent masses. It should be used in a peaceful way only to make the world a better place for everyone.
If in the near future any malware DNA attack comes, then biologists, computer scientists, cybersecurity professionals, and engineers will work together to develop robust bio-cyber defense systems. The only goals should be to protect humanity from unseen threats and deliver secure, ethical, and resilient technological progress without compromising biological or digital integrity.
360 Antivirus Pro