DNA Carried Malware Into a Computer for 89 Dollars

89 dollars of DNA was enough to take over a computer. The attack sat in the genetic letters themselves, A, T, C and G. Years later, the machines that read them turned out to be even easier to break.

This research is from 2017, and I’m bringing it back on purpose. It is a clear buffer overflow story you can learn from, and in 2025 it stopped being a party trick.

Researchers at the University of Washington asked a question you do not hear often. Could a DNA sample itself carry an attack? So they built one and ordered it from a company that ships DNA to labs. Price tag: 89 dollars.

DNA is a sequence of four letters, A, T, C and G. A machine called a sequencer reads those letters and writes them into a file. A second program then reads that file to analyse the sample. If you want your DNA to run as code, you encode the code two bits per letter:

1

A = 00    C = 01    G = 10    T = 11

The researchers took an existing tool for this, fqzcomp, a program that compresses DNA files. They copied version 4.6 from its public source and added a hole to it. The hole was a function that stores each read in a buffer of fixed size. Feed it a read that runs longer than the buffer. The extra bytes spill past the end, and land where the next instruction should sit. That is a stack buffer overflow, one of the oldest bugs there is.

Now the strange part. Attack code has rules, and so does DNA, and the two fight each other.

A synthesis company will not print just any sequence. It rejects long runs of the same letter, because the strand folds on itself and the machine misreads it. Their first attempt had thirteen T’s in a row, produced by a single jump in the code, and the printer allows only nine. The classic filler value 0xdeadbeef made it worse, stretching into a long repeat that made the strand curl up on itself.

The company also rejects sequences low in G and C, because those two letters bind more tightly and hold the strand together. Each stretch of twenty letters needs at least a quarter G and C to survive.

So they tuned the exploit like a chemist. They dropped from 64-bit to 32-bit code to shrink the pointers and shorten the runs of repeated letters. And the detail I keep coming back to: they changed the network port their shell called home. Port 3 encodes to ATAT, too weak to print. Port 9 encodes to ATGC, which holds. They picked a TCP port to keep a molecule stable.

For the payload they skipped a normal shell, which was too long to fit in a strand. Instead they used an old bash feature, /dev/tcp, which opens a network connection straight from the shell. Combined with a return-to-libc call to system(), the exploit fit in 43 bytes. Their finished strand was 176 letters long and began CTATCGGAATTGAGCGAGTTCGCACGCCC.

Then they sequenced it. The machine produced 811,118 reads of the sample. The exploit worked on 37.4 percent of them, because a single misread letter breaks the code. If all four lanes of the run were processed, the odds of it firing at least once were 84.5 percent. When it fired, the analysis program opened a shell back to the researchers. A working computer attack, delivered in a test tube.

Be fair about the setup. They turned off the usual memory defenses first, and they added the hole themselves. This was a lab built for the best odds, not something showing up in a routine sample.

The part worth worrying about is not the DNA. It is what they found next.

They took the tools biologists use, bwa, bowtie2 and samtools, the ones that ship on Illumina sequencers. Then they counted the unsafe code inside them. On average, two dangerous C functions per thousand lines, the strcpy and strcat and sprintf family that has caused overflows for thirty years. That is more than they found in internet-facing software that gets attacked for a living. Here is the kind of code sitting in that pipeline:

1
2

sprintf(len_buf, "LN:%d", header->target_len[tid]);
strcat(newtext, len_buf);

No length check, straight into a buffer. That snippet comes straight from a widely used sequencing tool. Several of the maintainers said they had not thought about the security of their tools.

For years that stayed a footnote. Then in January 2025, a security firm called Eclypsium looked at the sequencer hardware itself, the Illumina iSeq 100, and found something plainer and worse. The machine boots firmware from 2018, the low-level code that starts it before anything else. Secure Boot, the check that catches tampering with that startup code, was switched off. The protection that blocks changes to the firmware was missing. In all, Eclypsium counted nine weaknesses, four of them high severity.

Here is what an attacker on that network could do:

• → Brick the machine so it never starts again
• → Plant an implant in the firmware that survives a reboot
• → Change the output and fake what a person’s DNA says

These are not cheap gadgets. Sequencers find cancers, spot drug-resistant bacteria and help make vaccines. A machine that goes dark, or quietly lies about its results, is a bigger problem than a frozen laptop.

Eclypsium reported it to Illumina, and Illumina shipped a fix. The motherboard comes from another maker, IEI, so the same weak setup may sit in other machines too.

And this was not Illumina’s first scare. In 2023, a separate flaw in its sequencers scored a perfect 10 out of 10. It was serious enough that both the FDA and CISA put out warnings. NIST had already said, in a 2023 report on genomic data, that this hardware needs integrity checks. The warning was on the shelf. The iSeq 100 did not meet it.

The lesson runs through both years. Anything a computer reads can become code, if someone is patient enough to shape it. In 2017 that was a strand of DNA. In 2025 it was the firmware of the machine reading it. The input is never only data.

Two of the five researchers behind the 2017 DNA attack, Karl Koscher and Tadayoshi Kohno, had pulled a similar trick years earlier. In 2010 they shut off the engine and brakes of a moving car through its onboard computers. They proved a car is a computer. Then they proved DNA is data going into one. The same idea, years apart: anything a computer reads is a way in.

The idea did not stay still. In late 2025, a Microsoft-led team published a study in Science. AI tools, they found, could redesign a dangerous protein so its DNA slipped past the filters that synthesis companies use to screen orders. Researchers called it the first zero-day for biosecurity. They patched the screening with the industry before publishing, and even then about 3 percent of the highest-risk variants still get through. But that is for another time.

This is the kind of attack I teach in my ethical hacking course. How buffer overflows work, how attackers find the weak spot, and how plain data turns into running code. Ethical Hacking Course, zero to expert:

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

USENIX Security 2017 | Eclypsium | CISA ICSMA-23-117-01 | NIST IR 8432 | Science | IEEE S&P 2010