A weakness in one common open source software for genomic analysis left DNA-based medical diagnostics vulnerable to cyberattacks. Researchers at Sandia National Laboratories identified the weakness and notified the software developers, who issued a patch to fix the problem and updated the software for the next release. While no attack from this vulnerability is known, the National Institutes of Standards and Technology recently described it in a note to software developers, genomics researchers and network administrators.
The discovery reveals that protecting genomic information involves more than safe storage of an individual’s genetic information. Genome sequencing begins with cutting and replicating a person’s genetic information into millions of tiny pieces. A machine then reads each piece numerous times and transforms images of the pieces into sequences of building blocks, commonly represented by the letters A, T, C and G. Finally, software collects those sequences and matches each snippet to its place on a standardised human genome sequence.
One matching programme used widely by personalised genomics researchers is called Burrows-Wheeler Aligner (BWA). Sandia researchers studying the cybersecurity of this programme found a weak spot when the programme imports the standardised genome from government servers. The standardised genome sequence travelled over insecure channels, which created the opportunity for a common cyberattack called a “man-in-the-middle.”
In this attack, an adversary or a hacker could intercept the standard genome sequence and then transmit it to a BWA user along with a malicious program that alters genetic information obtained from sequencing. The malware could then change a patient’s raw genetic data during genome mapping, making the final analysis incorrect without anyone knowing it. Practically, this means doctors may prescribe a drug based on the genetic analysis that, had they had the correct information, they would have known would be ineffective or toxic to a patient. Forensic labs and genome sequencing companies that also use this mapping software were temporarily vulnerable to having results maliciously altered in the same way.
“Once we discovered that this attack could change a patient’s genetic information, we followed responsible disclosure,” said Corey Hudson, a bioinformatics researcher at Sandia who helped uncover the issue. “Our goal is to make systems safer for people who use them by helping to develop best practices.”
