Before the University of Washington researchers could hack a computer with DNA, they had to get somebody to manufacture their malware. They submitted a sequence to a commercial DNA synthesis service. The supplier could not make it. A sequence that worked as computer code had failed the requirements for becoming a molecule.[3]
In 2017, researchers encoded malicious computer instructions in synthetic DNA and used the sequenced data to take over a computer. The demonstration worked on software they had deliberately made vulnerable, not an unsuspecting laboratory's ordinary system.[1][2]
Peter Ney, Karl Koscher, Lee Organick, Luis Ceze and Tadayoshi Kohno had brought two kinds of expertise to the same experiment: computer security and DNA manipulation. They wanted to follow a possible attack all the way from a physical sample to the machine processing its data. Could something arriving in a test tube eventually tell that computer what to do?[2][3]
At the synthesis service, their first attempt ran into the habits of actual molecules. The sequence repeated itself too much. It contained long runs of the same genetic letter, and some stretches had too little of the bases C and G. Repetitive DNA can fold into troublesome structures; an order that looks sensible as computer instructions can be difficult to manufacture as a strand.[3]
The researchers went back to their code and redesigned it around those constraints. Their working strand was 176 bases long. The service accepted the revised sequence without errors or warnings, and the paper recorded the retail synthesis price for a fragment of that size: $89. For that part of the experiment, the security team needed a manufacturer, not another programmer.[3]
Once the DNA was ready, they sent it through a sequencing run alongside other experiments. Sequencing translated its molecules into the familiar letters A, C, G and T. The team then passed the resulting data to a modified DNA-compression program. The computer connected back to their server, giving them remote control. The sample had entered as laboratory material and emerged as instructions the computer obeyed.[3]
Before that run, the team had deliberately inserted a weakness in the program and disabled common computer protections. They were testing whether an attack could survive the trip through synthesis and sequencing. They had arranged unusually favorable conditions for the last step. Their result did not establish that an ordinary sample could commandeer an ordinary lab computer.[2][3]
In a separate examination of 13 widely used DNA-processing programs, the researchers found poor security practices and demonstrated three buffer-overflow vulnerabilities. A lab might receive samples from outside customers, then pass their sequenced data through a succession of programs. The team wanted the programmers handling those files to consider the person who might have prepared the sample. The team urged better safeguards while saying it knew of no attacks against sequencing systems at the time.[2][3]
On the study's public website, the researchers answered a question that made the experiment sound like a different kind of threat: would this infect anyone's genome? No. The sequence had no biological significance.[2] In the paper, a photograph shows what they had actually made: a small laboratory tube holding their synthesized exploit. Before any computer could mishandle it, somebody had to get the order right.[3]
