Holy crap. Malware hidden in a strand of DNA hijacks the computer that analyzes that particular gene sequence.

We're going to live in a very weird world man.

https://www.wired.com/story/malware-dna-hack

Biohackers Encoded Malware in a Strand of DNA

Researchers planted a working hacker exploit in a physical strand of DNA.

@LoganDice "and I hope YOU'VE learned to sanitize your inputs!"
@LoganDice this has white-collar gov't espionage written all over it, holy shit
@LoganDice The researchers on this project modified the source code of the program they were actually attacking though. Yes they did find some vulnerabilities in other DNA sequencing software, but when you read the full details this doesn't sound that scary.
@LoganDice @XavCC Voilà, LÀ tu vas commencer à intéresser du monde au hackerspace :P
#LaFolieDesGenes ...
@LoganDice considering the state of auto-correct, humans are really ready to scr*w the p00ch
@LoganDice In a way, it's logical, from the analyzing program's point of view, the DNA only ever is input data, but still… wow.
@otini @LoganDice Woow, I'm rather on the "it's amazing" side rather than "it's awful" side for now 😲
otini (@[email protected])

760 Toots, 155 Following, 129 Followers · M2 Computer Science student (aspiring PhD). My interests: Static program analysis • Binary executable analysis • Metaprogramming

@LoganDice Repeat after me: NO USER INPUT IS SECURE.
@LoganDice Proof of concept might be a bit generous. Contrived hypothetical more like it.

@LoganDice

Maybe get a mysql engineer to audit that sequencer code?

@LoganDice I knew I wasn't ceazy when I wanted to use a free software gene sequencer.
@LoganDice @[email protected] omfg this is such great near future sci-fi fodder.

@LoganDice
This is the most cyberpunk thing I read this weekend..

#cyberPunk

@LoganDice That's just sensationalist nonsense. Obviously, even if the gene sequencers were developed by people stupid enough not to have anticipated this, it's a simple software/firmware update to make it impossible.

Essentially, they're simply describing the equivalent of adding a partially quoted SQL command to a form field to mess with a web server's database.

These days, all important web servers escape data in a way that makes this impossible.

@LoganDice how do you even manage to exec() literal nucleotide sequences
@LoganDice If that's an article based on the paper I remember reading eons ago: it's 20 levels of theoretical, and barely even qualified as a proof of concept…
@LoganDice imagine something like that targeting 23andMe and shopping genetic sequences for clients. They require you to use a "real" name when you use the service too...
@LoganDice this is the most cyberpunk shit EVER
@LoganDice @tinker A bit less spooky after you find out the "DNA exploit" researchers had altered their software to create the buffer overflow vuln that was exploited by their trick DNA. (See grafs under "far-off threat" in the Wired piece.) Still very interesting...
@LoganDice this is fucking brilliant, I'm not even mad
@LoganDice Thinking about a scenario...

@LoganDice
https://www.nature.com/articles/nature23017

This is shortly bevor that Sequenzer hack.
I am waiting for HD-DNA Movies. Just Insert the DNA in the Videoplayer and there you geht the newest Hollywood Blockbuster.

@LoganDice this sounds like a high level of renaming your kid to a mysql injection string
@LoganDice This sounds very much like something that would happen in Orphan Black, the best sci-fi thriller series for learning about genetics and what evil uses DNA can be put to.
@emi cyberpunk criminal whose DNA is encoded with malware that hacks the CSI computers that try to analyze it

@fariparedes getting an ~SQL Injection~ full of viruses that slip a database-wiping script into your blood cells

just in case you get shot on a run

@LoganDice @haskal

tired: digital viruses infecting digital things
wired: organic viruses infecting digital things

@LoganDice

I'm pretty sure that most of my DNA is malware.

Gonna encode a rickroll link into my DNA too. Make them think that was the payload, while it hacks into their servers and scrambles all their data.
@LoganDice Sounds like a great tool for wrecking proprietary DNA databases that use our collective genetic info for a variety of benign and nefarious purposes!
@LoganDice I'd call this common sense, SANITIZE YOUR FUCKING INPUTS