hello it is such a pleasure to be
presenting for biohacking village at
defcon 29 today my name is gary
schumacher and i'm the cto and
co-founder of gene infosec where we are
working on technology to protect genetic
information i'm also a cyber security
engineer at valencia where we build
design test and secure medical devices
but today i'm here for one thing only
and that is to discuss the security of
your digital dna from inception to death
i'm going to begin with some quick
background information on what genetic
information and dna are
and how we use them for good and maybe
bad purposes
we're going to continue that discussion
by with a tour of the processes and
technologies required in order to
convert your dna into digital data as
well as discuss the threat surface along
the way
we'll conclude with some high-level
summaries for moving forward
so for those of you that slept through
biology class
dna is found in the nuclei of your cells
the nucleus is kind of like the brain of
the cell tells the cell how it's going
to be made how it's going to behave what
its functions are
your genome is made up of all the dna
found in your cells
it's about 7 billion ac's t's and g's in
length
your genetic code is converted into
digital data through a process called
dna sequencing
dna is present in nearly every life form
we generate genetic information
from humans from medical research from
plants and animals for agricultural
research and more and for microbes to
study disease
and genetic data is becoming incredibly
inexpensive to produce the cheaper it is
to produce this data the more of it will
produce and the more of it will use
currently in the us sequencing a human
genome cost right about a thousand
dollars i'm blocking that part of the
graph but currently today it's right
around a thousand dollars
however if you send your dna to china it
will only cost you one hundred dollars
to sequence your full genome
what a steal
human genetic data is providing us with
great benefits but each benefit brings
the potential for misuse
so consider ancestry research
it has brought us a better understanding
of our history
but it can also be used to identify
somebody from just their dna
and that dna can then be used by your
doctor to not only find out which
diseases you might be susceptible to but
also to potentially prescribe dna
specific treatments
however your genetic vulnerabilities
could likewise be used to cause you
illness or worse
furthermore we have to consider the
future biotechnology is rapidly advanced
advancing and offering us really cool
things like mrna vaccines designer
organisms but this same technology can
be applied to create bioweapons
so how easy is it to identify you based
upon your dna
well
just by having a relative in a public
database this can greatly narrow down
the potential sources of a dna sample
through genealogy
which is how mr d'angelo here was
finally id'd as the golden state killer
this solved a cold case that was it was
cold for over 30 years following his
final crime spree
and your face can already be
reconstructed from your dna alone using
artificial intelligence
these reconstructions are not yet great
but if you were to add a large database
of faces say if someone were able to get
their hands on a driver's license
database or similar
well now dna can be used to accurately
reconstruct uh sorry to actually
identify you
by coupling the dna data with the faces
as biotechnology improves
identifiability of dna will become
increasingly accurate
everyone has different needs for privacy
so this may have serious implications
for some more so than others for
instance just consider the case of
undercover operatives
john sotos gave a really great talk at
defcon 25
at the time he was the chief medical
officer of intel he went over many ways
in which families ethnicities and even
individuals could be targeted and
exploited through bioweapons
so if you don't plan on sleeping for a
few nights and you want to learn a bit a
little bit more about how bio weapons
could potentially be used against you or
your loved ones please watch us talk
google's deep mind group has open
sourced their ai based protein folding
prediction tool called alpha fold
this tool makes accurate protein
structure predictions based only on the
dna sequence
obviously this will of course lead to
amazing advancements
but can it also be used to design bio
weapons
the terrorists of the future may not
need to have any biological expertise as
we seem to be automating these processes
for them
and if the kobit 19 global pandemic has
been a difficult time then imagine what
our world would look like in the case of
a true bioterrorism or biowarfare event
cobit has given us just a taste of what
biowarfare could be like and has
potentially already inspired bad actors
to pursue bioweapons development after
seeing its global effects
if your dna is insecure you could find
yourselves on the front line of a bio
attack in the future
your dna is yours for life
and the threats we face today will pell
in comparison to these sci-fi like
threats that we could potentially face
in the future
so genetic information it's very
sensitive we've gone over many reasons
for that
so you would assume then maybe it should
always receive the highest levels of
protection then right
not always here's just one example of
thousands of genetic records being
exposed on public servers
there are many other breach and exposure
examples that have been disclosed either
affecting genetic information or maybe
not genetic information but definitely
companies that handle it
so how many breaches are yet to even be
discovered
as with most enterprises and industries
we do not know the true exposure of our
most sensitive information
genetic data is not tightly regulated in
the u.s
for instance the only time that hipaa
actually protects your dna is when a
diagnostic test is performed in the
clinic or by a clinician
it is not protected when you send your
dna off for research or recreational
purposes
nevertheless genetic data breaches can
have legal consequences for consequences
for organizations that mishandle this
data
the point of inception for genetic data
is in the laboratory
so genetic information security has to
begin there
but just how secure are these labs and
these environments
in 2019 we began investigating that
question by partnering with faculty and
students from the university of colorado
boulder to assess the cyber security of
labs and their infrastructure
specifically around genetic information
and dna sequencers
a really quick thank you to the numerous
people that donated time resources
thought
from gene infosec cu boulder volentium
and vto labs on this work especially to
my three students corey arya and ashish
pictured here
we started our research by first
reaching out to anyone that was
generating processing using regulating
genetic information
we interviewed professionals of various
departments and roles at these
organizations
but they all had one thing in common
they handled genetic information that
they themselves viewed as sensitive for
various reasons whether that be privacy
for monetary value for intellectual
property for regulatory reasons
most of these groups had a wet lab that
sequenced dna and we toured as many of
the facilities as we could we assessed
the labs and their equipment but many of
the clients were hesitant due to
specific concerns with contracts of
certain vendors of certain lab equipment
we'll come back to that
others though allowed us to dig deeper
into their systems and devices and we
even purchased a few sequencers to fully
disassemble and really dig in
so we've been in contact with with these
vendors to report our findings and
upgrades have been made to some to
mitigate some of the issues that we are
reporting today
so following this work we published a
paper in frontiers in bioengineering and
biotechnology it reviewed the threat
surface from literature but also from
our own findings and observations and
from the uh interviews that we had with
these with these people
i'll discuss what we published in that
paper and i'm also going to share some
new stuff with you today
to begin in the paper we provide a basic
data flow diagram and this describes the
process of generating and processing and
applying genetic information
instead of boring you with that diagram
i'm going to walk you through every step
of the process and we're going to
discuss that threat surface at each step
so first samples must be collected
in humans we really just need any cell
that contains dna
commonly we get that from blood saliva
tissue or even hair
most commonly you're probably most
familiar with saliva from direct to
consumer test
but fraud exists so be careful who you
send your dna to there are several
examples of dna samples being collected
never being accounted for and groups
being billed for services that were
never performed
another exploit already possible at this
early stage is was displayed by some
academic researchers
they were able to encode malware in
synthetic dna itself
so that when the dna was sequenced the
malware would reside in the resulting
data file
the researchers also then modified a
common analytical software tool so that
when the software tool analyzed the
sequence data containing the malware the
hosting computer would be remotely owned
through a reverse shell
now this may seem like a very academic
or difficult or unlikely exploit
but remember likelihood can never be
considered when malicious intent is
involved
and as we'll see later software tools
used in biology are easily tampered with
exploits such as this do present serious
concerns for synthetic biology
collected samples must then be
transported to labs and stored for use
usually this involves reduced
temperatures and controlled humidity and
gas levels
the research grade refrigerators that
i'm showing in the lower right have iot
sensors for monitoring sample storage
iot is everywhere in these environments
from the moment samples are collected
and delivered to a lab they're being
tracked using limbs or laboratory
information management systems
limbs which are generally depicted by
this crazy diagram here are integrated
into almost every step of the sequencing
process including sample tracking lab
and chemical processes the quality
insurance and quality control processes
in the lab all the way up to the human
resources and financial systems of these
institutions and even electronic health
care records in the clinical setting and
of course throughout all of the data
analysis
limbs touch it all please remember that
one such tool called dna limbs was
tested by shore break security and found
to have seven vulnerabilities in their
web app that are now tracked as cves
the vendor was notified in early 2017.
maybe you can see where i'm going with
this
of course over two years later these
vulnerabilities remain unpatched when a
story broke out of iranian hackers
exploiting this issue to compromise the
web app and its connected systems and
data
bad patching practices are very common
in these environments
now that samples are on site and a lab a
series of chemical processes must be
applied to samples to extract and purify
their dna prior to sequencing
we call these wet labs because they use
a lot of liquids versus dry labs that
have that are much more on the
computational analysis side
these labs depending on whether they are
academic or industrial have a lot of
people moving in and out of them
constantly
in our work we seem to always find
shared accounts between personnel
posted credentials near devices and
little to no bring your own device
policies or enforcement
there was severely limited physical
security in terms of authorized and
authenticated access video surveillance
weak locks there was pretty much uh
rarely anything to deter detect prevent
unauthorized access
and when and when they were implemented
it was very weak implementations
labs are also filled with the latest and
greatest tech
some of this is required for lab
operations so take the lo the robot on
the left there for example it automates
much of these processes instead of
pipetting a bunch it'll do it all for
you
devices like the these are even included
in the biohacking village device lab
which i applaud thermo fisher for
including a lab device in there so be
sure to check those out but a lot of the
devices in this industry are are old not
regularly updated and almost all of it
is connected to the internet
some of these latest and greatest
devices you will find however are
completely unnecessary
and they introduce some serious security
issues into the ecosystem
so for example this wonderful roomba
it's just wandering around many labs
that we saw
building a map of the facility using its
uh you know built-in camera mic wi-fi
bluetooth
for the sake of convenience security is
often overlooked in these environments
dna sequencers are a heart of genetics
labs
they are produced by a variety of
manufacturers and use many different
technologies to generate genetic data
some of the most common vendors and
platforms i have included here
especially in north america and europe
and they all have different
considerations for secure use sequencers
all run a different variety of operating
system
for example many of them run
can be introduced into a system that
runs windows linux or mac or they ship
with one of those distributions already
in them
there are even sequencers being built in
use with mobile phones so that
everything is becoming small and
accessible
sequencers may have external
workstations or internal computers to
control hardware and store and process
data and they are obviously incorporated
into many different networks
they all have connected cloud
infrastructure and
these devices are constantly connected
to the internet for operation for data
analysis for data storage and sharing
and even for device monitoring and only
some purposes
you can see our paper for more details
on these sequencing technologies and
products
but regardless of the product regardless
of the implementation there are certain
responsibilities that fall on the vendor
and certain responsibilities that fall
on the labs
these relationships are dictated through
service contracts very strict service
contracts which we will come back to
in general with these devices we find
security by implementation and not
security by design leading to a constant
cat and mouse game pinning these labs
against experienced threat actors
and even when we say security by
implementation it often was not done
when we dug into these systems we found
that they are not always configured or
maintained well
as late as last year there were
operational sequencers running windows 7
windows vista windows xp
and common security features that are
available in the products shipped with
the products were disabled
now we are under the impression that
these products have been upgraded to
windows 10 as of late last year
but at the end of the day
sequencers run a lot of third-party and
proprietary software so labs have to be
aware of all software operating within
their systems and of course vendors must
harden these products
the external workstations and data
stores of these devices can even leak
information for example the above grade
workstation on the left has removable
one terabyte hard drives
in that red box
so
just a friendly recommendation before
you ever sell a sequencer be sure to
actually wipe the data from it not just
move it to the trash bin not just delete
it once because you never know who might
purchase that sequencer later
luckily this time it was the good guys
but you never know
almost every sequencer we examined also
had external usb ports ethernet ports
many other
ports in
access capabilities that were largely
unrestricted physically or by software
we often found wireless keyboards mice
and wi-fi dongles being used as well
external power supplies and backups are
even common in case of power failure
shown by the black blocks in the left
image to the right of the gray
workstation
these products are also networked for
monitoring purposes and every power
supply that we found used in a lab with
a dna sequencer
was found to have disclosed cves
affecting their firmware and the
software residing on the host computer
this could obviously greatly impact the
availability of sequencing systems
physically disassembling these products
also proved useful in entangling how
they operate
programming and debugging interfaces
were plentiful and largely unrestricted
there were many pins and pads that were
available and and everything was so well
nicely labeled that i would have been
able to easily solder to them
provide the right amount the right power
play around figure out the pin out but
instead i decided to forget forgo that
because every single board in one of
these sequencers that we uh analyzed had
perfect little ports that fit my j-link
debugger default cable perfectly
even in one of these devices we found a
usb stick internal to one of the
machines and it wasn't hard for us to
figure out where it had been where it
had been what had been used for or who
had used it
we also the actual components processors
external flash
other internal components
they were so well labeled that we could
uh just read off of them the
the vendor the product name the firmware
version the firmware name
finding datasheets was was so easy
so for now i'll just summarize all of
this by saying that standards and best
practices are not always complied with
in these environments especially for
secure device development
flow cells are a necessary consumable
used in dna sequencers these are special
glass slides such as the ones shown on
the right image
and this is where dna molecules actually
sit in within the dna sequencer itself
so there's little special attachment
points on the glass dna sticks to them
so following a sequencing run dna
remains on those flow cells
we saw used flow cells everywhere in
labs they were on tables they were in
drawers they were everywhere and we were
even given a few as
fun souvenirs
so we wondered
could dna be recovered from these flow
cells and if so
then could dna be re-sequenced to then
leak that information
turns out it's far more simple than we
even dreamed of
just simply rinse the flow cells with
water and re-sequence the molecules
that's it
it's probably not the easiest way to
steal genetic information but that might
just depend on how badly someone wants
your data
of course it would be far easier to just
hack the system and target electronic
components in downstream data stores
where data is amassed
there are various ways that data is
stored following sequencing including
external hard drives computers and local
servers depending on operational
constraints we always saw a computer it
was a part of the actual sequencer
itself either internal or external plus
we always saw one other local method of
storage whether that be the hard drive
or the server
however we also always saw cloud storage
it's being used
more and more because of the large
amounts of data that these these
sequencers produce
every organization we we assessed used a
cloud platform provided by their dna
sequencing vendor and usually that lab
also implemented independent cloud
platforms of their own for further
storage and for other analyses
the cloud implementations we looked at
rarely had just simple things like
user authentication or deferring user
authentication role-based access
different accounts for every user
multi-factor authentication
along with many other controls and
configurations that were either not
enabled or misconfigured
these cloud platforms also
especially when dna sequencing vendors
provide them
host their own laboratory information
management systems which we looked at
everywhere saw how they touch everything
also these four these are for the
primary vendors of dna sequencing
technology they each provide their own
cloud platform
all running uh aws as the underlying
cloud infrastructure so we'll get to a
chain of custody concerns here in a bit
when dna sequencers are communicating
with
internet connected infrastructure like
the cloud we found outdated and insecure
protocols in place for example we found
tls version 1.1 being used by sequencers
still in late 2020
late 2020
while uh a while after being notified of
that and other issues the vendor has
since upgraded their stack
but in general we found week week
cryptography and use
low and medium strength keys of
insufficient size
flawed number generators and cipher
suites with known vulnerabilities and
these were used for critical things like
authentication encryption
pki
we also found labs that implemented
their own internal stacks for
transmitting data to local servers
server message block protocol version 2
was using was being used by a few labs
to transmit data to their local server
in plain text
so that anyone on the network could with
some
with a little bit of know-how could
sniff that data quite trivially and the
way that i got on the network was asking
people walking by hey i really need to
check my email can you can you give me
your wi-fi credentials
easy as that
file transfer protocol ftp not ftps was
also found in use
furthermore wi-fi capabilities for some
reason ship with these products even
though we have yet to see a single lab
use wi-fi for a dna sequencer they
produce so much data that and there's
there's a bandwidth requirement and
these systems are so sensitive and
important to the operations of labs that
they
we always saw them using a directly
wired ethernet connection
at the end of the day labs need to be
aware of the protocols necessary to keep
their data secure in motion and in
transit and much more and vendors must
design products so that labs are
actually able to securely implement and
operate them
once data is produced it must then be
processed
so raw sequencing data can range in the
gigabyte to terabyte size
it's from just from just sorry from just
a single sequencing run
so all of that data must undergo a lot
of quality control and a lot of analyses
for that useful information to be teased
out
bioinformatic pipelines are a series of
software tools that we use just for that
and also due to the large amount of data
they must process we're seeing more and
more of this go to the cloud as well as
be implemented within a dna sequencer so
that some initial processing is done on
on the sequencer and then everything
else is shipped off to the cloud as it's
generated and processed further there
so one such example of just the rampant
security issues with bioinformatics
software is the bureau wheeler aligner
sandia lab researchers uncovered a
buffer overflow vulnerability that could
lead to a man-to-middle attack
potentially exposing sensitive genomic
information or even tampering with that
information while it's being processed
every bioinformatic pipeline requires
several categories of tools for many
different functions which you can see on
that first left column
and several tools exist through each of
these categories
each by each pipeline is different
because they'll use different tools and
it all depends on the use case so a
research group examined these tools for
security and code quality and lo and
behold they found they are not very
secure this should not be a surprise
when you actually step back and consider
that all most of the software is
produced by academics hosted on public
repos with very little oversight and
security is not yet a primary concern
for these developers
almost every tool was found to use
functions that are known to be insecure
and lead to potential buffer overflows
and they all contain static buffers
so here's some actual snippets of code
we see strlin strcap and mem copy all
used without proper validation and
bounce checking which these are just
known to be insecure functions in the
first place they were not implemented
securely and they are um
and like memcop is a known insecure
intrinsic that should be avoided
once processed genetic data often ends
up being amassed in large databases
the access to these data stores data
stores can range from open to semi-open
to closed and some are much more
security-minded than others
so quick question do you actually know
where your genetic data is
oftentimes it can be very difficult to
find out
so with all of the parties we have seen
so far involved in these ecosystems this
does present real chain of custody
concerns because once a dna sample is
shared a large number of third parties
are involved in handling that material
or data
and we as consumers or patients have
very little control over where that
information goes
genetic data needs to be protected from
the ins from its inception throughout
your entire life perhaps even after your
death
to protect future generations that share
your dna
the genetics and genomics industries can
still create breakthrough advancements
without sorry while protecting these
sensitive information systems
we can we can better prepare for the
current and future threat landscape
and uh here's a few overarching
solutions for how this might be
accomplished
so really it falls on uh it's a shared
responsibility
but labs have to do everything they can
to first not not chase a bunch of
technical controls or technologies but
to start with the basics
you have to
give your personnel awareness and
training so that fishing links and and
other low-hanging fruit items can be
avoided
you have to
have the appropriate processes and
policies in place but appropriate
policies will actually enable a culture
of security and security can be a
process improvement tool if implemented
correctly
and then again before technical controls
can be applied
these groups really need to
sit down and consider their liabilities
consider their risk
understand their threat surface threat
model
and now that we've done that then then
you can start adding security
strategically throughout your
organization
this will be difficult to do it might be
scary for biologists who lack this
expertise there are security
professionals out there who want to help
you
of course this is not solely fallen labs
vendors and developers
have to adhere to best practices this
will not only uh protect their ip but it
will protect their clients ip allow
their clients to securely generate and
handle their their own data add
marketing opportunities to their
products and of course enable
drastically needed biosecurity and this
starts with just adding security to the
entire development life cycle of every
product from the when you're first
thinking about user needs
all the way through when that device
becomes decommissioned through its end
of life
uh you know that's that that means
regular testing early and throughout
that means threat modeling before
anything is ever built or compiled
that means looking at best practices and
conventions and standards and following
them and using methods to ensure that
you are
now many of the speakers of this year's
biohacking village will discuss these
technical concepts in much much more
detail than i
and of course in order to drive all of
this industry wide regulations will be
critical the medical device industry is
miles ahead it's not perfect but it's
miles ahead of most other similar
industries in terms of product security
and this is because the fda now mandates
that every product that goes through a
submission process has artifacts and
documentation and analyses done in order
to ensure that that product can be used
safely and effectively with patients and
in hospitals
we similarly need to require the
protection of diagnostic data and also
the entire ecosystem that processes that
information
so with all these challenges and
potential solutions we believe that the
clearest solution is to apply
cryptography directly to dna molecules
so that information can be protected
before it ever touches a dna sequence or
computer but you'll have to wait till
our next talk to learn more so thank you
to defcon thank you to biohacking
village please reach out to us if you
have any questions or concerns and i
hope you all enjoyed this and learned a
bit about how genetic information is
used the good the bad the ugly
so i leave you with this
as consumers and patients as users
awareness will be the biggest key you
must research and can seriously consider
the risk first versus the benefit before
sharing your genetic data with anyone
and you have to look at everyone that
touches it as much as possible
as hackers as technologists as
biologists we all must play our part
improving these systems so that we can
cure diseases so that we can improve
life without compromising on safety
health or privacy
we all have a shared responsibility to
protect genetic information today and in
the future
thank you stay safe