https://www.sciencedaily.com/releases/2019/07/190702152755.htm
Personalized medicine software vulnerability uncovered
Discovery led researchers to software fix
Date:
July 2, 2019
Source:
DOE/Sandia National Laboratories
Summary:
A weakness in one common open source software for genomic analysis left DNA-based medical diagnostics vulnerable to cyberattacks. Researchers identified the weakness and notified the software developers, who issued a patch to fix the problem. The issue has also been fixed in the latest release of the software, and no attack from this vulnerability is known. . . . .
The discovery reveals that protecting genomic information involves more than safe storage of an individual's genetic information. The cybersecurity of computer systems analyzing genetic data is also crucial, said Corey Hudson, a bioinformatics researcher at Sandia who helped uncover the issue.
Personalized medicine -- the process of using a patient's genetic information to guide medical treatment -- involves two steps: sequencing the entire genetic content from a patient's cells and comparing that sequence to a standardized human genome. Through that comparison, doctors identify specific genetic changes in a patient that are linked to disease.
Genome sequencing starts with cutting and replicating a person's genetic information into millions of small pieces. Then a machine reads each piece numerous times and transforms images of the pieces into sequences of building blocks, commonly represented by the letters A, T, C and G. Finally, software collects those sequences and matches each snippet to its place on a standardized human genome sequence. One matching program used widely by personalized genomics researchers is called Burrows-Wheeler Aligner (BWA).
Sandia researchers studying the cybersecurity of this program found a weak spot when the program imports the standardized genome from government servers. The standardized genome sequence traveled over insecure channels, which created the opportunity for a common
cyberattack called a "man-in-the-middle."
In this attack, an adversary or a hacker could intercept the standard genome sequence and then transmit it to a BWA user along with a malicious program that alters genetic information obtained from sequencing. The malware could then change a patient's raw genetic data during genome mapping, making the final analysis incorrect without anyone knowing it. Practically, this means doctors may prescribe a drug based on the genetic analysis that, had they had the correct information, they would have known would be ineffective or toxic to a patient.
Forensic labs and genome sequencing companies that also use this mapping software were also temporarily vulnerable to having results maliciously altered in the same way. Information from direct-to-consumer genetic tests was not affected by this vulnerability because these tests use a different sequencing method than whole genome sequencing, Hudson said.
Personalized medicine software vulnerability uncovered
Discovery led researchers to software fix
Date:
July 2, 2019
Source:
DOE/Sandia National Laboratories
Summary:
A weakness in one common open source software for genomic analysis left DNA-based medical diagnostics vulnerable to cyberattacks. Researchers identified the weakness and notified the software developers, who issued a patch to fix the problem. The issue has also been fixed in the latest release of the software, and no attack from this vulnerability is known. . . . .
The discovery reveals that protecting genomic information involves more than safe storage of an individual's genetic information. The cybersecurity of computer systems analyzing genetic data is also crucial, said Corey Hudson, a bioinformatics researcher at Sandia who helped uncover the issue.
Personalized medicine -- the process of using a patient's genetic information to guide medical treatment -- involves two steps: sequencing the entire genetic content from a patient's cells and comparing that sequence to a standardized human genome. Through that comparison, doctors identify specific genetic changes in a patient that are linked to disease.
Genome sequencing starts with cutting and replicating a person's genetic information into millions of small pieces. Then a machine reads each piece numerous times and transforms images of the pieces into sequences of building blocks, commonly represented by the letters A, T, C and G. Finally, software collects those sequences and matches each snippet to its place on a standardized human genome sequence. One matching program used widely by personalized genomics researchers is called Burrows-Wheeler Aligner (BWA).
Sandia researchers studying the cybersecurity of this program found a weak spot when the program imports the standardized genome from government servers. The standardized genome sequence traveled over insecure channels, which created the opportunity for a common
cyberattack called a "man-in-the-middle."
In this attack, an adversary or a hacker could intercept the standard genome sequence and then transmit it to a BWA user along with a malicious program that alters genetic information obtained from sequencing. The malware could then change a patient's raw genetic data during genome mapping, making the final analysis incorrect without anyone knowing it. Practically, this means doctors may prescribe a drug based on the genetic analysis that, had they had the correct information, they would have known would be ineffective or toxic to a patient.
Forensic labs and genome sequencing companies that also use this mapping software were also temporarily vulnerable to having results maliciously altered in the same way. Information from direct-to-consumer genetic tests was not affected by this vulnerability because these tests use a different sequencing method than whole genome sequencing, Hudson said.
Last edited:
