# Cyberbiosecurity: DNA Injection Attack in Synthetic Biology

Dor Farbiash
Jusidman Science Center for Youth at Ben-Gurion University of the Negev  Rami
Puzis
Cyber Security Research Center and Software and Information Systems
Engineering Department at Ben-Gurion University of the Negev

###### Abstract

Today arbitrary synthetic DNA can be ordered online and delivered within
several days. In order to regulate both intentional and unintentional
generation of dangerous substances, most synthetic gene providers screen DNA
orders. A weakness in the Screening Framework Guidance for Providers of
Synthetic Double-Stranded DNA allows screening protocols based on this
guidance to be circumvented using a generic obfuscation procedure inspired by
early malware obfuscation techniques. Furthermore, accessibility and
automation of the synthetic gene engineering workflow, combined with
insufficient cybersecurity controls, allow malware to interfere with
biological processes within the victim’s lab, closing the loop with the
possibility of an exploit written into a DNA molecule presented by Ney et al.
in USENIX Security’17. Here we present an end-to-end cyberbiological attack,
in which unwitting biologists may be tricked into generating dangerous
substances within their labs. Consequently, despite common biosecurity
assumptions, the attacker does not need to have physical contact with the
generated substance. The most challenging part of the attack, decoding of the
obfuscated DNA, is executed within living cells while using primitive
biological operations commonly employed by biologists during in-vivo gene
editing. This attack scenario underlines the need to harden the synthetic DNA
supply chain with protections against cyberbiological threats. To address
these threats we propose an improved screening protocol that takes into
account in-vivo gene editing.

##  1 Introduction

Synthetic biology is an emerging bioengineering technology that plays a
significant role in personalized medicine, pharmaceutical manufacturing,
etc.[45, 41]. Rapid development of biological systems is supported by large
online libraries of genes [34, 60, 5], as well as integrated development
environments (IDEs) and gene compilers for efficient gene coding [18].
Currently, the software stack used to develop synthetic genes is loosely
secured (Section 4.1), potentially allowing the injection of rogue genetic
information into biological systems by a malware.

DNA synthesis companies, which produce and ship the DNA sequences, are an
important element of the growing synthetic biology market. Synthetic DNA is
available in multiple ready-to-use forms, such as a circular DNA molecule
called a plasmid (Section 2.1). A synthesized plasmid can be inserted into an
organism by following a simple biological protocol, after which it can start
producing proteins [44]. Many bioengineering tools are now easily accessible
by do-it-yourself (DIY) biology enthusiasts.

The products of biological systems can be extremely dangerous substances, such
as toxins or synthetic viruses [13, 36]. DNA sequences producing dangerous
viruses may be as small as 1.7kbp [26]; natural and synthetic toxins may be
constructed from less than 100bp [42]. The dual use of synthetic biology as a
powerful technology for the benefit of mankind, and as a potential weapon, is
a long-standing issue [50]. The dangers of synthetic biology are manifold, and
they require rigorous security controls [24, 59]. One such control is the U.S.
Department of Health and Human Services’ (HSS) Screening Framework Guidance
for Providers of Synthetic Double-Stranded DNA (HHS guidelines) [49]. We
discuss state-of-the-art DNA screening in Section 2.3. Biosecurity researchers
agree that constant improvement of DNA screening methodologies is required to
prevent both bioterrorists, and careless enthusiasts, from generating
dangerous substances in their labs [50, 37]. Legislation is keeping pace.
Recently California obliged all customers to order synthetic genes from
companies that perform gene screening [58].

Understanding the impact of cyber threats on biosecurity is extremely
important. Cyber attacks are considered a potential threat to the security and
privacy of genomic data [27, 12] and the analysis of genetic material [22]. A
recent biodefense report [50] mentions cyber threats with respect to
identifying potential targets and the development of bioweapons. Diggans and
Leproust [20] highlight the value of cybersecurity methods applied in the
domain of biosecurity. Ney at el. [47] have even suggested an attack where an
exploit written in a DNA molecule may subvert a vulnerable sequencing machine.

However, the potential of delivering a harmful biological agent through
cyberspace has not yet been considered. It is currently believed that a
criminal needs to have physical contact with the substance to produce and
deliver it. However, malware could easily replace a short sub-string of the
DNA on a bioengineer’s computer with a toxin producing sequence. Order
screening by synthetic DNA providers is the most effective line of defense
against such attacks. Unfortunately, the screening guidelines have not been
adapted to reflect recent developments in synthetic biology and cyberwarfare.

In this paper we discuss two main attack vectors:

(1) A traditional biosecurity vector where an adversary orders a dangerous
synthetic DNA:

  * •

We show that a weakness in the HHS guidelines can be exploited by the attacker
to avoid detection by obfuscating the malicious DNA (Section 3.1).

  * •

The proposed Gene Edit Distance (Section 3.2) can efficiently detect sequences
that can be decoded into malicious DNA within living cells.

  * •

A benchmark dataset of obfuscated DNA sequences demonstrates the superiority
of Gene Edit Distance over a rigorous implementation of the HHS guidelines
(Section 3.3).

(2) A cyberbiological attack vector where malware on the biologist’s computer
interferes with biological processes:

  * •

We discuss the attack surface of a synthetic biology pipeline (Section 4.1)
and highlight the overlooked impacts malware may have on biological processes
(Section 4.5).

  * •

We demonstrate an end-to-end scenario where a malware within a biological lab
tricks the biologist victim into producing a substance of the attacker’s
choice. This scenario closes the loop with a potential attack propagating from
DNA to cyberspace [47] and stresses the importance of designing adversary-
resilient biological protocols.

  * •

Simple mitigation steps applied by DNA providers (Section 4.6) may
significantly reduce the threat of a cyber attack propagating to the
biological space.

##  2 Background and related work

This section provides the most important information required in subsequent
sections, where we describe potential cyberbiological threats and their
mitigation. Readers familiar with the basics of protein synthesis and the
CRISPR-Cas system are encouraged to skip Section 2.1. Important terms used
later in the paper are highlighted in bold face.

###  2.1 An introduction to DNA editing for cybersecurity experts

Genetic information in living cells is encoded in sequences of nucleotides
called DNA. Nucleotides are commonly denoted by four letters, C,G,A, and T,
corresponding to four nucleobases; cytosine, guanine, adenine, and thymine,
respectively. In a double-stranded DNA (dsDNA) molecule, nucleobases on the
opposite strands are bound together, C with G and A with T. Thus, dsDNA is
sometimes seen as a sequence of base pairs (bp). The fees charged by gene
synthesis companies for synthetic DNA orders are typically based on the number
of base pairs. The orders are commonly delivered in the form of cyclic dsDNA
molecules called plasmids which are very stable and can be replicated within a
living cell. The price for a plasmid can be as low as five cents per base
pair. Once provided with a plasmid, one can employ a sequencing procedure to
get the string representation of the DNA molecule. Companies that produce
synthetic DNA usually also provide sequencing services.

A complement of a DNA sequence is formed by replacing every occurrence
character with its pair ($C\leftrightarrow G,A\leftrightarrow T$). A reverse
complement of a DNA sequence, an operation commonly used in gene design, is
formed by reversing the complement of a DNA sequence. For example, the
complement of GGCA is CCGT and its reverse complement is TGCC.

Along with other cell functions, DNA encodes proteins. First, an RNA sequence
is generated from a DNA region surrounded by special sequences called
promoters and terminators. An RNA molecule contains the same information as
the respective DNA, but it is short-lived. In computer terms it can be
compared to volatile memory, whereas DNA would be considered persistent
storage. RNA containing special sequences called ribosome binding sites can be
transformed by a ribosome into a sequence of amino acids. Every three
nucleotides form one amino acid, but different triplets (a codon) may form the
same amino acid. Translating amino acids back to triplets of nucleotides is
called reverse translation. The choice of which triplets are optimal depends
on the organism in which the DNA is expressed. There are 20 amino acids. Short
sequences of amino acids are called peptides, while long sequences are called
proteins. Both perform various functions within a living cell.

The clustered regularly interspaced short palindromic repeats (CRISPR) complex
is a part of the bacterial immune system that was adapted by bioengineers to
perform precise DNA editing in live biological systems. The most common DNA
editing system consists of a Cas9 protein and a guide RNA sequence (gRNA). In
this article we will use the term CRISPR to refer to the DNA system consisting
of Cas9 and gRNA. The Cas9 protein performs a cut in a dsDNA molecule at
specific locations called protospacer adjacent motifs (PAMs). The gRNA
contains a short replica of the region following the PAM that needs to be cut
by Cas9. In computer terms, gRNAs can be regarded as pointers in an
associative memory. For gRNA creation, the DNA should contain a promoter, a
copy of the gRNA target site, and a terminator; collectively these are
referred to as a gRNA scaffold.

A dsDNA that was cut by a CRISPR can repair itself. Such a repair process is
error prone and can produce mutations at the cut point. If such a mutation
results in production of a different amino acid during protein formation, the
protein may become non-functional (a.k.a. a gene knockout). Precise repairs of
the cut DNA can be performed using a process known as homology directed repair
(HDR). To activate HDR, the cell should contain a DNA sequence that repeats
the sequence of nucleotides to the left and right of the cut point (left and
right arms of the HDR template respectively) and a small number of nucleotides
that can be inserted between them at the cut point. HDR can also correct a few
small mutations close to the cut point. Using CRISPR and HDR it is possible to
remove and replace long DNA fragments, a process known as knock-in [57, 51].
The success rate of knock-in may vary significantly, from 2-3% up to almost
80% [28, 40].

###  2.2 Sequence alignment

Next we discuss sequence alignment, which plays a significant role in
bioengineering and in biosecurity. The Basic Local Alignment Search Tool
(BLAST) [3] is the first of a long series of algorithms developed for aligning
sequences of nucleotides or amino acids. BLAST algorithms are optimized both
for speed and for searching large databases of sequences. Let $q$ denote a
query sequence and $t$ denote a subject sequence (also called a target
sequence). Let $q[i]$ denote the $i$’th character in $q$. BLAST operates by
matching n-grams—short sequences of letters (words)—and extending these
matches to form local alignments between the sequences.

Provided a query sequence, BLAST returns a set of target sequences similar to
the query sequence and a set of alignments (also called ranges) for each
target sequence. Let $\mathcal{A}_{q,t}$ be a set of such alignments between
$q$ and $t$ found by BLAST. Every alignment in $\alpha\in\mathcal{A}_{q,t}$
maps a range of character positions (a substring) in $q$ to a range of
character positions (a substring) in $t$, such that any two successfully
aligned character positions $i>j$, $\alpha(i)>\alpha(j)$. Although $\alpha$ is
not a function, we use the terms domain ($dom(\alpha)$) and image
($img(\alpha)=a(dom(\alpha))$) to denote the respective substrings. Let
$\alpha^{-1}$ denote the inverse alignment, such that
$dom(\alpha^{-1})=img(\alpha)$ and $img(\alpha^{-1})=dom(\alpha)$.

The score of an alignment is computed based on the number of matched
characters ($M=|\\{i:q[i]=t[\alpha(i)]\\}|$); the number of mismatched
characters ($MM=|\\{i:q[i]\neq t[\alpha(i)]\\}|$); the number of gaps opened
in both the query and the target sequences
$G=|\\{i:\alpha(i-1)\neq\bot\wedge\alpha(i)=\bot\\}|+|\\{i:\alpha^{-1}(i-1)\neq\bot\wedge\alpha^{-1}(i)=\bot\\}|$;
and the total extent of the gaps
($GX=|\\{i:\alpha(i)=\bot\\}|+|\\{i:\alpha^{-1}(i)=\bot\\}|$), where $\bot$
means that the argument character is not aligned. There is a reward ($rm$) for
every matching character and penalties for mismatching characters ($pmm$), gap
opening ($pgo$), and gap extension ($pgx$). The reward and penalties are
configurable. The score of an alignment is:

$Score=rm\cdot M-pmm\cdot MM-pgo\cdot G-pgx\cdot GX$

The fraction of $q$ characters successfully aligned is called query coverage:
$QC(\alpha)=\frac{MM}{\left|q\right|}$. The percent identity is computed from
the sizes of the domain, the image, and the number of successfully mapped
characters: $PI(\alpha)=2\cdot
MM/(\left|dom(\alpha)\right|+\left|img(\alpha)\right|)$

###### Example 1

Consider the following alignment:
$\alpha=\\{(1,1),(2,2),(3,\bot),(4,3),(\bot,4),(\bot,5),(5,6),(6,7)\\}$ .

$\begin{matrix}dom(\alpha)&\texttt{1234~{}~{}56}\\\ q=&\texttt{TAGT\textemdash
CA}\\\ \alpha=&\texttt{||~{}~{}~{}~{}||}\\\ t=&\texttt{TA-CGGCA}\\\
img(\alpha)&\texttt{12~{}34567}\end{matrix}$ (1)

The first two characters and the last two characters are identical, the fourth
is a mismatch, and there are three gaps. The query coverage of $\alpha$ is
$QC(\alpha)=4/6$, the percent identity is $PI(\alpha)=\frac{2\cdot 4}{6+7}$,
and the fraction of gaps is $Gaps(\alpha)=3/8$.

###  2.3 Related work on DNA screening

Some DNA sequences may encode extremely dangerous products, such as toxic
peptides. The Screening Framework Guidance for Providers of Synthetic Double-
Stranded DNA (HHS guidelines), published by the United States Department of
Health and Human Services, suggests methods to minimize the risk of
unauthorized distribution of select agents [49]. Highly related to the HHS
guidelines are the Harmonized Screening Protocol v2.0 (HSP), employed by the
International Gene Synthesis Consortium (IGSC) [15], and the International
Association Synthetic Biology (IASB) Code of Conduct for Best Practices in
Gene Synthesis [29].

The HHS guidelines, IASB Code of Conduct, and HSP outline standards and
practices aimed at preventing the misuse of synthetic genes. They define
procedures for customer screening and synthetic gene order screening for the
presence of possible toxins, pathogens, and other biological agents that pose
a significant threat to public health and safety, which are collectively
referred to as sequences of concern (SoC). US regulation also defines items on
the Commerce Control List as sequences of concern.

While the HHS guidelines recommend screening specifically for the presence of
sequences unique to sequences of concern, the HSP recommends identifying
sequences derived from or encoding a sequence of concern. It is generally
advised to use a sequence alignment tool, such as BLAST (the Basic Local
Alignment Search Tool) [3], to compare gene orders with known sequences in the
GenBank database [5]. HHS guidelines recommend the _Best Match_ approach to
determine the legitimacy of an order based on the classification of the most
similar sequence in the database. Specifically, every fragment of 200bp in the
order is searched within the database using sequence alignment. If the _Best
Match_ of any fragment is a sequence of concern, the order is deemed a hit,
and it is forwarded for further investigation. False hit rate is a major issue
during screening.

GenoTHREAT [1] software implements the HHS guidelines. The query sequence is
partitioned into 200bp fragments. We evaluate the disclosed attack and defence
against GenoTHREATand our own rigorous implementation of the HHS Guidelines
based on BLAST. Another software relying on sequence alignment for order
screening is BlackWatch [32]. Early versions of both GenoTHREAT and BlackWatch
were released as open source but were retracted later due to biosecurity
concerns. Note that general security practice advises against security by
obscurity, striving instead for rapid identification and elimination of
security weaknesses by the public. A recently published NNTox [30] screening
tool employs Gene Ontology (GO) Terms and machine learning for predicting the
toxicity of a sequence. Unfortunately, the published NNTox models failed to
identify conotoxins and other short toxic peptides during preliminary tests
and thus was not included in the evaluation.

In addition to biosecurity tools, there are multiple systems such as
InterProScan[31], SeqScreen[2], and various machine learning approaches [39,
62, 21] that can be used to predict the function of DNA and protein sequences.
These approaches provide detailed information for the human analyst to
investigate a hit including both suspicious and legitimate elements found
within the DNA. In this article, we primarily argue against the _Best Match_
principle in DNA screening which allows an adversary to evade detection.
Similar to the cyber warfare, the penetration of machine learning and
adversarial learning into biosecurity domain should increase.

###  2.4 HHS guidelines criticism and responses

There are multiple concerns regarding the HHS guidelines [19], including the
possibility of assembling a SoC using new bioengineering tools. For example,
using Gibson assembly, oligos (short DNA molecules) may be assembled to
construct larger fragments [23]. Since the HHS guidelines do not address
oligonucleotide screening, one might order small DNA fragments which are not
screened [37] and can be assembled to create pathogens.

The HHS guidelines do not specify a database to use for screening, but it does
suggest the GenBank as an example of such a database. The lack of a formal
database of SoCs is a problem, since it may lead to inconsistent screening
protocols between companies, false positives due to housekeeping genes shared
between pathogenic and non-pathogenic organisms, and increased cost of overall
screening [37]. Housekeeping genes are required for basic cellular functions
but do not produce toxins or other dangerous products. Nevertheless,
housekeeping genes have long been known to cause false hits [6]. A curated
database of SoCs may reduce the cost of sequence screening [11, 2]. Other
concerns are the possibility of poisoning public databases with adversarial
sequences that have been misclassified as benign, whether mistakenly or with
malicious intent [12].

The HHS guidelines recommend screening all sequences ordered, regardless of
their length. Some argue that screening DNA fragments that are shorter than
200bp may lead to false positives and increased cost [1], while others argue
that the 200bp cutoff is not scientifically justifiable [55]. We provide
justification for a 60bp cutoff in Section 3.1.

###  2.5 Related cyber attacks

Cyberbiological attacks are reminiscent of attacks on physical assets, such as
critical infrastructure or industrial control systems, from cyberspace [46,
38]. They are perhaps most similar to attacks on additive manufacturing [61],
where malware on the victim’s computer manipulates blueprints of parts being
produced on a 3D printer. Those parts may function (or malfunction) far away
from both the cybercriminal and the victim, extending the reach of the former.
Similarly, here the adversary affects a biological substance without direct
contact with it. The fundamental difference between cyberbiological attacks
and cyberphysical attacks is that, DNA can and should be considered as an
executable code, although, executable in a non-digital environment. A defect
inserted by a malware into a 3D printed rotor may cause a drone to crash. But
malicious gene injected into a DNA order by a malicious browser plugin may
potentially subvert a DNA sequencing machine propagating back to the
cyberspace. This potential bio-cyber attack presented by Ney et al. in USENIX
Security’17 [47] closes the loop with the cyber-bio attack discussed here.

##  3 The biosecurity scenario

Consider a case where a bioterrorist in California wants to build a synthetic
virus or produce dangerous toxins, and distribute them locally. Synthetic DNA
providers, members of IGSC, are the first line of defense. Following is a list
of working assumptions considered in this section regarding the attacker and
the defender:

(1) The attacker orders long DNA sequences. We consider oligos out of scope
for this paper.
(2) The attacker places an order with one of the synthetic DNA providers that
screen orders. There are no other assumptions regarding the attacker.
(3) The defender automatically screens every order with a sliding window of
fixed size (200bp but may change) and hits are determined according to the
_Best Match_ approach. This assumption is well aligned with the HHS
guidelines.
(4) Only when there is a hit during automatic screening is the order forwarded
for further screening by a human analyst or by using DNA function prediction
tools. This assumption stems from the large number of orders, the large size
of DNA databases used for screening, and the significant computational
resources that are therefore needed [19, 21].
(5) We assume that all the malicious DNA sequences that the attacker tries to
order are found in the defender’s database. It is a worst-case assumption that
makes the obfuscation process described next more challenging.

Input:

${SoC}$ – a Sequence of Concern

SCREENER(__) – a black-box screening algorithm

Output: $O$ obfuscated Sequence of Concern

// @post-condition: Expressing $O$ in Cas9 containing environment results in
an assembly of $P$

1

2Partition SoC into 64bp fragments ${SoC}=f_{1}+f_{2}+\ldots+f_{n}$

3 $f_{1}\leftarrow$ promoter and ribosome binding site $+f_{1}$

4 $f_{n}\leftarrow f_{n}+$ terminator

5 Let $m$ be a 23bp long efficient Cas9 cutting site [17]

6 $m_{RC}\leftarrow$ reverse complement of $m$

7 $\forall_{1\leq i<n},f_{i}\leftarrow f_{i}+m$

8 $\forall_{1<i\leq n},f_{i}\leftarrow m_{RC}+f_{i}$

9 $Body=\sum_{i=1}^{n}$CAMOUFLAGE(_$f_{i}$_)

10 $\forall_{1\leq i<n},hdr_{i}\leftarrow$32bp suffix of $f_{i}+$ 32bp prefix
of $f_{i+1}$

11 Let $grs$ be a gRNA scaffold targeting $m$

// $grs$ also targets $m_{RC}$ on the opposite strand.

12 $Decoder=grs+\sum_{i=1}^{n-1}$CAMOUFLAGE(_$hdr_{i}$_)

// Assemble and return the obfuscated sequence

13 return _$O=Body+Decoder$_

14

15Function  _CAMOUFLAGE(_$x$_)_:

// Find benign gene $c$ that is most similar to $x$.

16 Find best scored $(c,\alpha)\in$ BLAST(_$x$ ,no gaps_) such that
$img(\alpha)$ is at least 200pb from $c$’s ends

17 $cx\leftarrow$ replace $\alpha(x)$ in $c$ with $x$

18 if  _SCREENER(_$cx$_)=hit_ then

19 error obfuscation failed

20 else

21 return _cx_

22

23

Algorithm 1 SoC Obfuscation 2 (SoCO2)

###  3.1 Below the DNA screening radar

At a glance, a sequence of concern (SoC) that needs to be obfuscated is split
into small fragments. The fragments are interleaved with legitimate DNA
sequences which are as similar as possible to the SoC fragments. As a result,
for every 200bp window the _Best Match_ is always a legitimate sequence. This
may sound like a trivial obfuscation against pattern-based detectors that long
ago became obsolete in cyberwarfare, but its biological implementation poses
several challenges, as discussed below.

We note that GenoTHREAT can easily be evaded due to its strict conditions for
identifying a hit. We omit the details here111See Appendix C for details on
SoCO1. because it is an attack against a specific vulnerable algorithm. Later
the specific attack against GenoTHREAT is referred to as level 1 SoC
obfuscation (SoCO1) and the generic attack described next as level 2 SoC
obfuscation (SoCO2).

Level 2 obfuscation allows a SoC to remain below the screening radar of
protocols implemented according to the HHS guidelines. Specifically, we
exploit the specification stating that if for every 200bp fragment of a query
sequence the _Best Match_ is NSoC, then the query is not a hit. The general
obfuscation process is depicted in Figure 1a-f and Algorithm 1 presents its
pseudocode. We will refer to the figure and the pseudocode while presenting
SoCO2.

Figure 1: Level 2 SoC obfuscation. Schematics of the SoC obfuscation process
(a-f); a DNA containing obfuscated $\alpha$-conotoxin PeAI and a decoder
sequence that facilitates its reconstruction (g); blast scores when scanning
an obfuscated sequence with a 200bp sliding window (h). Colors correspond to
the schematic on the left: green and blue lines are alignment scores with
camouflage genes, and the red line is the alignment score with the SoC
subject.

The main challenges an attacker faces in order to successfully evade detection
are:
(1) Finding legitimate DNA that can successfully camouflage the SoC fragments.
(2) Decoding the obfuscated DNA with a minimal set of standard biological
primitives commonly used in experiments.

#### The camouflage genes

Given a SoC, we split it into small fragments ($SoC=f_{1}+\ldots+f_{n}$). Plus
$+$ denotes string concatenation. We will refer to the length of these
fragments later in this subsection. In order to hide a SoC fragment we search
for a NSoC gene that is most similar to the fragment. We will refer to such
NSoC genes as _camouflage genes_.

The search for camouflage genes can be performed within standard nucleotide
and protein databases using BLAST 222https://blast.ncbi.nlm.nih.gov/Blast.cgi.
In order to efficiently find camouflage genes we search for each SoC fragment
($f_{i}$) while excluding organisms that are known to contain the SoC or
similar compounds. The search is performed with the lowest mismatch penalties
and the highest gap penalties.

In the following discussion, let $c$ denote the appropriate camouflage gene
and $\alpha$ denote an alignment between $c$ and $f_{i}$. In order to hide the
SoC fragment within the camouflage gene we replace the respective nucleotide
sub-sequence ($img(\alpha)$) with the SoC fragment $f_{i}$. This process is
summarized in Algorithm 1 function CAMOUFLAGE. See also Figure 1 a, c, and d.

The SoC fragments embedded within the camouflage genes constitute the main
body of the obfuscated DNA. In order to properly function within living cells
after decoding, the body also needs a promoter, a terminator, and a ribosom
binding site. See lines 1-3, 8 in Algorithm 1. The target organism chosen can
be one of the most prevalent organisms used in DIY biology, for example, E.
Coli.

#### The decoder

Similar to the old well-known encrypted or oligomorphic malware [52], building
a decoder is the most challenging part in designing obfuscated malicious DNA.
Here the decoder should operate inside living cells rather than in cyberspace.
Decoding is facilitated by the maturity and prevalence of CRISPR-based DNA
editing methods. In general, the decoder needs to perform two tasks when
reconstructing the malicious DNA: (1) It should remove the parts of the
camouflage genes between consecutive SoC fragments. (2) It should stitch
consecutive SoC fragments together, forming operational DNA.

In order to cut out parts of the camouflage genes during decoding, we add cut
points before and after each SoC fragment ($f_{i}\text{\char
34}camouflage\text{\char 34}f_{i+1}$). Cut points are marked using a 23bp
sequence $m$ which includes PAM and gRNA target site. The following example of
such a sequence is cut at the nucleotide marked with ✂.

$m=\scriptsize\begin{matrix}\texttt{CCTTCC}&\texttt{ACAAGCTCGCCGAGGTG}\\\
\texttt{GGAAGG}&\texttt{TGCTCGAGCGGCTCCAC}\\\ \underbrace{\texttt{~{}~{}\char
34~{}~{}~{}}}&\underbrace{\texttt{~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}}}\\\
\text{\scriptsize PAM}&\text{gRNA target sequence}\end{matrix}$ (2)

It is important to note that CRISPR may bind to either side of the double-
strand DNA molecule to perform the cut. Therefore, a reverse complement of $m$
(denoted $m_{RC}$) is cut from the opposite strand, as shown in Equation 3:

$m_{RC}=\scriptsize\begin{matrix}\text{gRNA target sequence}&\text{ PAM}\\\
\overbrace{\texttt{~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}}}&\overbrace{\texttt{~{}~{}~{}\char
34~{}~{}}}\\\ \texttt{CACCTCGGCGAGCTCGT}&\texttt{GGAAGG}\\\
\texttt{GTGGAGCCGCTCGAGCA}&\texttt{CCTTCC}\end{matrix}$ (3)

The gRNA target sites within the main body point to the locations that need to
be cut (see Algorithm1 lines 6-7 and Figure 1 e and f). In order to actually
perform the cuts the decoder should include the respective gRNA scaffold
targeting the cut points (see Algorithm1 line 10 and Figure 1 g). Cas9 that is
also required to perform the cuts is a part of standard gene editing
instrumentation which can easily be purchased online (Figure 6).

Next, there is a need to repair the DNA cut made by CRISPR when removing the
camouflage and to repair the residue PAM nucleotides333For example, the
leftmost GG on the lower strand in Equation 2.. Such a repair can be performed
using the HDR process which requires a 64bp long template ($hdr_{i}$) – a DNA
sequence covering both the last 32 nucleotides of $f_{i}$ and the first 32
nucleotides of $f_{i+1}$ (see Algorithm 1 line 9 and Figure 1 b). A 64bp long
HDR template is the shortest HDR template shown to perform well in practice
[51]. The longer the HDR templates are, and the more replicas of these
templates are found within the cell, the higher the HDR efficiency is. Since
$\\{hdr_{i}\\}$ are also fragments of the SoC sequence, it is important to
camouflage them in order to remain below the screening radar.

#### Obfuscation variants

There could be many variants of this general obfuscation scheme, including
variations of the gRNA binding sites. On the one hand, these sites may be
designed individually for each cut point in order to improve the stealthiness
of the obfuscation. But in this case they will require multiple gRNA
scaffolds, each targeting a different cut point, potentially reducing the
decoding’s effectiveness. On the other hand, repeated gRNA binding sites may
increase the likelihood of obfuscation failure.

The size of the SoC fragments and the HDR templates may also vary. Reducing
the size of the SoC fragments increases their likelihood of blending within
the camouflage genes. Yet it also increases the number of such fragments,
which leads to a larger number of cuts and repairs, consequently reducing the
effectiveness of the decoder. Since 64bp is the currently known lower bound on
the size of HDR templates, there is no point in using shorter SoC fragments if
they are ordered together with the HDR templates. The adversary may also
choose to order the main body and the HDR templates separately and reduce the
size of the SoC fragments.

###  3.2 Gene Edit Distance

In order to harden synthetic DNA order screening and reduce the non-regulated
distribution of select agents and toxins, we propose a new DNA screening
algorithm termed Gene Edit Distance (GED). The algorithm is designed to assess
the difficulty of SoC assembly from a DNA sequence. In order to do so, GED
screens the query sequence to find all substrings which are similar to
fragments of a SoC. Then, GED quantifies the effort of assembling a SoC from
these fragments. Although designed with a focus on SoC, GED can quantify the
effort required to assemble any target sequence $t$ from a query sequence $q$
using a standard CRISPR system. More specifically, we count the number of cuts
and repairs required for constructing the target sequence from the query
sequence.

In a standard biological sequence alignment, a typical objective is to
identify genes conserved in different genomes. To achieve this objective, the
match reward ($rm$), mismatch penalty ($pmm$), and gap penalties ($gpo$,
$gpx$) must be well balanced when computing the alignment score. GED’s
objective is more complex. On the one hand, we need to find short conserved
regions with minimal gaps within the query sequence. On the other hand, we
want to concatenate the short conserved regions regardless of the gap length
between them.

###### Example 2

A default configuration when aligning two sequences with BLAST [4] is $rm=2$,
$pmm=3$, $pgo=5$, and $pgx=2$. Figure 8 presents the results of aligning the
obfuscated $\alpha$-conotoxin PeIA444A short toxic peptide. from Figure 1 to
the PeIA sequence using default configuration. BLAST returns three ranges
(alignments). As long as $pgx>0$, these ranges will not be merged by BLAST due
to the length of the gap that would be opened in the target sequence. However,
when removing a sequence between two consecutive SoC fragments using the
CRISPR system and HDR templates, the distance between them does not play a
critical role.

#### Gap removal penalty

In order to achieve the objective of GED, we introduce a new gap removal
penalty ($prm$) that substitutes some gap opening and extension penalties
within the target sequence.555Note that variation of gap penalties for query
and target sequences has successfully been used in the past for other use
cases [54]. Let $g=[a,b]$ be a gap in the target sequence ($\forall_{i\in
g},\alpha(i)=\bot$). Removal of $[a,b]$ from the query sequence requires two
cuts, at $a$ and at $b$ respectively, followed by an HDR (e.g., Figures 3 and
5.10). These operations may fail. Let $\gamma$ be the probability that a gap
is successfully removed.

To define GED we neglect some biological constraints of the CRISPR system,
such as specific PAM sites targeted by Cas9, assuming that cuts can occur at
any point in a DNA sequence. This is a worst-case assumption overestimating
the potential risk. Future versions of GED may take biological constraints
into account to reduce false positives. Currently, in the absence of advanced
adversarial techniques, GED detects obfuscated SoC with 100% accuracy, as
shown in Section 3.3.

If the gap $g=[a,b]$ is removed, the score of the alignment will increase by
$pgo+pgx\cdot(b-a+1)$ and reduce by $prm$. Let $\mathcal{G}_{q}(\alpha)$ and
$\mathcal{G}_{t}(\alpha)$ be sets of all gaps in the query and target
sequences respectively according to the alignment $\alpha$. Let
$\mathcal{G}^{k}_{t}\subseteq\mathcal{G}_{t}$ be a subset of the $k$ longest
gaps in the target sequence to be removed. The probability that all gaps in
$\mathcal{G}^{k}_{t}$ will be successfully removed is $\gamma^{k}$. Next, we
adjust the alignment score as a result of designating $\mathcal{G}^{k}_{t}$
for removal.

######  Definition 1 (Adjusted alignment score)

Given an alignment $\alpha$; a subset of gaps $\mathcal{G}^{k}_{t}$ in the
target sequence of $\alpha$; gap opening and gap extension penalties $pgo$ and
$pgx$ respectively; gap removal penalty $prm$; and gap removal probability
$\gamma$; we define the change in the alignment score as the result of the
removal of the $k$ longest gaps in the target sequence $t$ as:

$Score^{k}(\alpha)=Score+\gamma^{|\mathcal{G}^{k}_{t}|}\cdot\sum_{g\in\mathcal{G}^{k}_{t}}\left(pgo+pgx\cdot|g|-prm\right).$

Next, we examine the choice of gaps to be removed ($\mathcal{G}_{trm}$) and
the parametrization of $Score^{k}$. We assume that the match reward ($rm$), as
well as the mismatch, gap opening, and gap extension penalties ($pmm,pgo,pgx$)
are set at their default values or according to the biological considerations
(which are beyond the scope of this article).

$Score^{k}$ approaches $Score$ when the number of gaps to be removed $k$
increases and $\gamma<1$. The choice of $\gamma$ depends on the assumptions
made regarding the expected biological effectiveness of the attacks given
typical bioengineering tools used by potential victims today. $\gamma=0$
signifies that no attacker could ever rely on residue Cas9 protein in the
cells and the SoC obfuscation attack described in Section 3.1 is impossible.
$\gamma=1$ signifies 100% success of gene editing, which leads to the
successful decoding of SoCO2 sequences regardless of the number of SoC
fragments.

The gap removal penalty $prm$ should be set to a value that would justify gap
removal using bioengineering tools. For example, if only the removal of gaps
larger than $x$bp is justified, then the gap removal penalty should be set to:

$prm=pgo+pgx\cdot x.$

Obviously, the longer a gap is, the more worthwhile its removal is. Thus, for
the sake of computing $Score^{k}$, only the longest gaps are selected. The
number of gaps $k$ that should be included in $\mathcal{G}^{k}_{t}$ for the
maximal $Score^{k}$ depends on the parameters and can be selected using a grid
search or simple hill climbing algorithm.

Figure 2:  Example of an alignment score correction using the GED $\Delta
Score$. (a) The gap length distribution of an example alignment. (b) The
corrected alignment score ($Score+\Delta Score^{k}$) for various choices of
$k$.

###### Example 3

Assume, for example, that we examine a 10Kpb long query sequence, comparing it
to a 2Kpb long SoC. Also assume a negatively scored optimal alignment between
the two sequences which contains 2K matching base pairs, a few mismatches, and
50 gaps whose length is exponentially distributed, as depicted in Figure 2a.
Although, such alignment exists, it will never be returned by the BLAST search
engine, because its score is worse than random. Assuming default BLAST
configuration, the specific alignment score could be lower than $-4,500$.
Assume a gap removal penalty of $prm=20$. Replacing gap opening and gap
extension penalties with $prm$ starting from the longest gaps would increase
the score, as shown in Figure 2b. With $\gamma=0.98$, setting $k=10$ results
in the highest $Score^{k}$ value. With $\gamma=0.99$, the adjusted alignment
score can reach $2,000$ when $k=13$ in this example.

###### Example 4

Further following Example 2, consider the alignment of obfuscated
$\alpha$-conotoxin PeIA with the unobfuscated peptide, as shown in Figure 8.
The blue alignment in Figure 8c, was not identified by BLAST, because it
contains very long gaps in the target sequence. Nevertheless, an adjusted
score with the gap removal penalty of $prm=20$ and $\gamma=0.99$, according to
definition 1, would result in a total score of 193 which is very close to a
best match.

#### GED definition

Next, we define the gene edit distance as the optimal number of gaps ($k$) to
remove in a query sequence such that the adjusted alignment score is
maximized.

######  Definition 2 (Unidirectional gene edit distance)

The gene edit distance (GED) from $q$ to $t$ is:

$GED(q,t)=\texttt{ARGMAX}_{k}\texttt{MAX}_{\alpha}Score^{k}(\alpha).$

According to this definition $Score^{GED(q,t)}(\alpha)$ has the maximal
adjusted score. Although we call GED a distance, it is not a valid
mathematical distance metric, first and foremost because it is asymmetric. GED
quantifies the effort required to transform $q$ into $t$ but not vice versa.
As an academic exercise, one can define a true gene edit metric, but such
definition is beyond the scope of this security article.

#### GED computation

Current BLAST implementations will not return suitable alignments which
minimize the small gaps but neglect the long ones. Thus, in order to reduce
time-to-market and maintain backward compatibility with existing BLAST
engines, we implement a GED heuristic as postprocessing of standard BLAST
outputs. The GED heuristic pseudocode is presented in Algorithm 2.

Input:

q – a query sequence

t – a target sequence

Output:

$k$ – the number of cut and repair operations

$Score^{k}$ – adjusted alignment score

// List local alignments $\mathcal{A}=\\{\alpha\\}$ sorted by
$dom(\alpha).start$

1
$\mathcal{A}_{q,t}=\textnormal{{BLAST(}}\textnormal{\emph{query=q,subject=t}}\textnormal{{)}}$

2 for  _each subset $P\subseteq\mathcal{A}_{q,t}$ of local alignments with
disjoint domains_ do

3 $\alpha_{P}=\textnormal{{MERGE(}}\textnormal{\emph{P}}\textnormal{{)}}$

4

5$P^{*}=\texttt{argmax}_{P}Score^{|P|-1}(\alpha_{P})$

6 return _$k=|P^{*}|,Score^{k}(\alpha_{P^{*}})$_

7 Function  _MERGE(_$\alpha_{1},\ldots,\alpha_{k}$_)_:

/* Find global alignment between unified domains and $t$ */

8
$\mathcal{A}=\textnormal{{BLAST}}(query=q[\bigcup_{i}dom(\alpha_{i})],subject=t)$

9 $\alpha=$ cleaned global alignment unifying $\mathcal{A}$

/* Reintroduce gaps to form a continuous alignment */

10
$\alpha\cup=\\{(i,\bot):i\in[dom(\alpha_{j}).end,dom(\alpha_{j+1}).start],1\leq
j<k\\}$ return _$\alpha$_

Algorithm 2 Gene Edit Distance

Standard BLAST algorithms compute a large set of small local alignments and
extend these alignments when doing so increases the alignment score. We take a
similar approach when computing a set of alignments using standard BLAST
configuration and merging them to maximize $Score^{k}$. Recall that
$\mathcal{A}_{q,t}$ is a set of local alignments between $q$ and $t$ returned
by BLAST (Algorithm 2, line 1). Let $.start$ and $.end$ denote the first and
the last position respectively, in the domain or the image of an alignment
$\alpha\in\mathcal{A}_{q,t}$. Let $P=\alpha_{1},\ldots,\alpha_{k}$ be a set of
alignments whose domains are disjoint,
$dom(\alpha_{i}).end<dom(\alpha_{i+1}).start$ (Algorithm 2, line 1). Their
images may overlap, as depicted in Figure 3. BLAST can find a global alignment
between the unified domains of the alignments and the target sequence i.e.
when sequence fragments between the alignment domains are removed. Such
unified alignments are called cleaned alignments according to BLAST.

Figure 3: Two local alignments with disjoint domains and overlapping images.

The output of Algorithm 2 is the number of cut and repair actions required to
reconstruct the target sequence from the query sequence and the adjusted
alignment score. The latter quantifies both the similarity of the body of an
obfuscated SoC and the effort required to decode it within the cells. Unlike
in the case of encrypted or oligomorphic malware where decoders are the
easiest to detect, here we concentrate on detecting the main body of the
obfuscated SoC, because the gRNA scaffolds and HDR templates comprising the
decoder may be distributed among different plasmids or even different orders.

In order to return a final assessment of the risk a query sequence presents,
the GED of the query sequence is evaluated against all SoC sequences in the
database. The final judgement is made based on the maximal adjusted score of
the query sequence for any of the SoC sequences. This allows the
identification of seemingly benign sequences that can easily be transformed
into malicious sequences that produce dangerous products. In addition, such an
approach is more resilient to an attack in which a public gene database is
poisoned with legitimate sequences, although poisoning with legitimate
sequences maliciously marked as a SoC may result in false hits and require
human attention.

###  3.3 Evaluation

In this section we evaluate different screening algorthms vs. the SoCO1 and
SoCO2obfuscation algorithms.

#### Benchmark dataset

For the purpose of evaluation we selected 50 SoCs from the UniProt database
[16], all of which are marked as toxins, are manually reviewed, and contain
between 33 and 100 amino acids. These protein sequences were reverse
translated to sequences of nucleotides using an EMBOSS online tool [43]. We
ran BLAST queries using the nucleotide SoCs to ensure that they are well
detected within the GenBank database using BLAST. Doing so, we identified
seven benign sequences with various levels of similarity to the SoCs. We
selected an additional 43 benign sequences from UniProt, non of which are
toxic and all of which are manually reviewed. The 50 SoC sequences were
obfuscated using Algorithms 3 and 1. To create the SoCO2 sequences, we
selected the camouflage genes from the 50 NSoC sequences described above.
Finally, we generated 50 random nucleotide sequences (denoted as Rnd) as a
reference point. There are a total of 250 nucleotide sequences in the
benchmark dataset, equally split among NSoC, SoC, SoCO1, SoCO2, and Rnd.

#### Baseline screening algorithms

GenoTHREAT can be easily circumvented, because it scans non-overlapping 200bp
fragments of the query sequence and employs very strict match constraints (see
Appendix C for details). In order to objectively assess the threat of DNA
obfuscation, we implement a screening method, referred to as GenoTHREAT plus
(GTP), that strictly implements HHS guidelines. While we don’t elaborate on
the algorithm here due to space constraints, we provide some highlights below.

GTP scans the query sequence with a sliding window of length 200bp and step
size of 1bp. Every such 200bp nucleotide sequence is searched in the database.
We use a set of keywords and anti-keywords to identify dangerous substances in
the returned results. GTP records the score of the best matching SoC as well
as the score of the best matching NSoC. Later, we derive a confidence value
from the difference between them. Querying both nucleotide and protein
databases for each sequence of 200bp is a highly inefficient, yet accurate
approach that strictly follows the HHS guidelines.

In addition to GenoTHREAT and GTP, we employ a heuristic screener based on
InterProScan 5 [31], a state of the art DNA and protein functional annotation
framework. The heuristic referred to as IPC, produces a hit if at least one of
the tools within InterProScan annotates at least some part of the evaluated
DNA as a toxin.

#### Results

Benchmark sequence screening was performed using local copies of the complete
GenBank NT and NR and UniProt databases. While GenoTHREAT, IPC, and GTP
require the entire database for accurate screening, GED only requires the SoCs
to compare with the query sequences.

Figure 4: GTP, IPC, and GED confidence levels for five types of sequences in the benchmark dataset. Table 1: Number of hits produced by different screening approaches.  | GenoTHREAT | GTP | IPC | GED
---|---|---|---|---
SoC hits | 50 | 50 | 45** | 50
SoCO1 hits | 9 | 50 | 44 | 50
SoCO2 hits | 7 | 34 | 28 | 50
NSoC hits | 0 | 0 | 0 | 0
Rnd hits | 0 | 3 | 0 | 0
TPR | 0.44 | 0.89 | 0.87 | 1.0
FPR | 0.0 | 0.03* | 0 | 0.0
FNR | 0.56 | 0.1 | 0.13 | 0.0

We expect a good screening algorithm to report a hit when screening sequences
in the SoC, SoCO1, or SoCO2. We expect a non-hit when screening sequences in
the NSoC or Rnd. Similar to studies focusing on malware detection, we consider
the true positive rate (TPR), the false negative rate (FNR), and the false
positive rate (FPR). High FNR (low FPR) indicate that the screening method can
be evaded using obfuscation. Since some malicious sequences are easier to
detect than others, we the hit counts for each group of sequences. In order to
analyze the performance of the screening algorithms, we also inspect their
confidence levels.

While GenoTHREAT only provides a binary decision on a query sequence, GTP can
provide a confidence level along with the decision. We compute the GTP
confidence as follows. Let $q$ be some 200bp fragment of the screened
sequence. Let $Max{SoC}(q)$ and $Max{NSoC}(q)$ be the highest score of an
alignment of $q$ with a SoC and NSoC respectively. If BLAST did not return
alignments with SoC or NSoC, we set the respective score to zero. We define
GTP confidence as

$GTPConf=\max_{q}\left\\{\frac{Max{SoC}(q)-Max{NSoC}(q)}{\max\\{Max{SoC}(q),Max{NSoC}(q)\\}}\right\\}$

$GTPConf>0$ means a hit, because there is at least one 200bp fragment that is
more similar to a SoC than to an NSoC.

The confident of IPC is the fraction of toxin annotations out of all
successful annotations produced by InterProScan when screening $q$.
$IPCConf>0$ means a hit.

The confidence of GED ($GEDConf$) is simply the maximal adjusted score it
returns when screening $q$. The value of $GEDConf$ is between zero and one,
where $GEDConf=1$ means that $q$ is definitely a SoC.

Table 1 summarizes the performance of GenoTHREAT, GTP, and GED on the
benchmark dataset. Confidence levels of GTP and GED when screening the 250
benchmark sequences are presented in Figure 4.

As expected, all SoCs are the closest to being malicious (right part of the
chart) and all NSoCs are the closest to being benign (left part of the chart).

Most random sequences are classified by GTP as benign (low negative
confidence), because there are many more benign sequences than toxic sequences
in the GenBank database. Nevertheless, some random sequences contain 200bp
fragments that are more similar to a SoC than to an NSoC. One such fragment is
sufficient to produce a hit and require human attention. We consider such
statistical errors as an inherent deficiency of the _Best Match_ approach.
According to GED, random sequences are similar to benign sequences with
respect to the effort required to transform them into something dangerous.

Next, we observe a high variance of the confidence levels of obfuscated
sequences in Figure 4 for all screening methods. While SoCO1 sequences are
always detected, some SoCO2 sequences remain below the radar of the _Best
Match_ approach, represented here by GTPadn below the radar of InterProScan
functional annotation. This is due, of course, to the camouflage genes which
contribute the most to the PI value in each 200bp fragment. The partitioning
into fragments makes it harder for InterProScan to detect functional segments.
Nevertheless, some SoCO2 sequences are detected, because no sufficiently
similar camouflage gene was found during obfuscation. An important conclusion
from these results is that some sequences are easier to obfuscate than others.

GED successfully detects all obfuscated malicious sequences. Moreover the
large confidence gap between the most suspicious benign sequence and the least
suspicious malicious sequence ensures GED’s robustness as a screening
algorithm. We also note that GED is an order of magnitude faster than
GenoTHREAT, because it compares the query sequence with a small database of
SoC and does not need to query for every 200bp fragment.

##  4 DNA injection as a cyberbiological attack

In this section we introduce an attack pattern called _DNA Injection_
following the common template of Attack Pattern Enumeration and Classification
(CAPEC) descriptions.666https://capec.mitre.org/ In contrast to classical
biosecurity scenarios, the attack pattern discussed here assumes that the
attack originates from cyberspace as do all cyberphysical attacks.

In the discussed attack scenario, a victim might be a do it yourself (DIY)
biology enthusiast or a small bioengineering company that develops their own
DNA sequences or combines existing genes to produce fuel, medical components,
or resilient plants. We assume that the victim does not use their own
facilities to produce the DNA but prefers ordering synthetic DNA strands from
synthetic gene providers. Figure 5 (steps 1-9) depicts a common workflow of a
biologist experimenting with gene editing. First, the biologist designs a
system for adding, removing, or replacing a gene in some target organism (e.g.
E. Coli) using CRISPR, and then places a synthetic gene order with one of the
providers, who screens the order for possible inclusion of SoC. During the
production a provider typically sends the biologist updates on production
status and quality control. Once the DNA is produced, a tube is delivered to
the biologist. Large labs prefer sequencing the order they received to ensure
its quality, but DIY biologists and many small companies would trust the
quality reports sent by the provider. Finally the synthetic genes are applied
to the organism of interest and their biological effects are assessed. The
attacker is a cybercriminal who wants to trick the biologist victim into
producing dangerous biological components inside the victim’s lab. For this
purpose the attacker may design an obfuscated malicious gene as described in
Section 3.1.

Figure 5: A typical synthetic biology workflow (1-9), weaknesses (a-e red
underlined), and attack components (a,c,d,e purble bold). course of an RDI
attack. The cell transformation schematic (9) depicts the decoding of the
malicious DNA within a cell.

###  4.1 Related weaknesses

#### Endpoint security

DIY biologists are well trained in biosafety protocols and aware of
biosecurity screening and the dangers of engineering pathogens, similar to
most bioenginers [25]. However, like most computer users, they cannot be
trusted to properly secure their end devices and mitigate social engineering
attacks. It is a common assumption that the end customer may be infected with
malware (Figure 5a) and providers as well as software vendors must be alert to
that.

#### Data at rest

The first line of defense should have been provided by the integrated
development environments (IDEs) for DNA coding. IDEs provide the ability to
create and edit DNA sequences. We inspected the electronic integrity features
provided by typical DNA IDEs, such as SnapGene, Serial Cloner, ApE (A plasmid
Editor), and Genome Compiler, most of which support one or more common DNA
file types, such as .genbank, .fasta, and .dna. Some of the file formats are
binary, but they do not contain electronic signatures or other means of
integrity protection (Figure 5.b). This allows a malicious attacker to change
the sequences within DNA files without the user’s consent.

#### Communication

Most communication with gene synthesis companies, including gene orders, takes
place through a company’s website or email. All synthetic gene orders are
validated prior to purchase and during production. Unfortunately, most
validation reports are delivered through the same channel which, in the case
of an attack, is presumably controlled by the attacker (Figure 5c). Standard
end-to-end encryption provided by HTTPS does not help when the data is
corrupted, for example, by a malicious browser plugin. None of the gene
libraries, such as GeneBank, NCBI etc., provide electronic signatures for data
download. 777Some projects, such as InterProScan provide MD5 checksum for
large downloads but this is insufficient. None of the providers request a
validation record for submitted orders.

#### Biosecurity screening

Although gene orders are screened by providers, screening algorithms are aimed
at computational performance and achieving zero false hits. Current official
screening recommendations have multiple weaknesses (Figure 5.d); we elaborated
on one of the weaknesses, which enables an attacker to evade detection by a
common screening protocol, in Section 3.1. Additionally, small orders of less
than 200bp might not be screened; neither are orders for short single-strand
DNA (oligos). Fortunately, constructing a pathogen from oligos requires expert
knowledge and dedicated effort, and thus the biologist victim is unlikely to
be tricked into constructing a pathogen without being aware of it. Yet
obfuscated malicious genes, capable of reconstructing and activating
themselves, pass unnoticed. Biosecurity protocols for customer screening won’t
help in this case since the malicious genes would be ordered by a legitimate
customer.

#### Biological protocols

Bioengineering best practices focus on safety and efficiency. Most biological
protocols today do not take into account cyber threats, or any adversarial
manipulation of the genetic material, relying instead on physical perimeter
security when biosecurity is a concern (Figure 5.e). One example of a
biological-grade vulnerability is negligence of Cas9 expressing DNA after
performing the intended cuts in the DNA. CRISPR best practice recommends
discharging of gRNA in order to avoid unintended cuts during subsequent phases
of the experiment. However, the Cas9 expressing DNA is usually left intact
within the cells.

###  4.2 Prerequisites

In order to carry out a DNA injection the attacker must be able to interfere
with the victim’s communication with the synthetic DNA provider, which can be
achieved using a malicious browser plugin or malware. Minimally, the attacker
needs the ability to modify the DNA order, either while it is stored on the
victim’s computer or when it is submitted to the provider. The ability to
modify provider reports will help to conceal the attack from the victim. A
malicious browser plugin is sufficient for all attack objectives if the
victim’s communication with the DNA providers takes place via the Web,
including via a webmail client. This is a valid assumption for most DYI
biologists and small bioengineering companies.

###  4.3 Skills and resources

An attacker need only possess the resources of an average individual, and an
intermediate level of sophistication [53]. For example, they must be able to
write a trojan plugin for a browser; intercept, parse, and modify a pdf file
found as a webmail attachment or downloaded from the Web; and successfully
execute a man-in-the-browser attack technique [33]. The attacker is, however,
unable to penetrate the security premises of synthetic DNA providers.

The attacker must know the basics of synthetic biology and should be able to
target DIY biologists or small bioengineering companies working with CRISPR.
Targeting may be performed via synthetic biology forums where the attacker
promotes the attack agent.

###  4.4 Execution flow

CAPEC defines three attack phases: Explore, Experiment, and Exploit. The first
two phases include the reconnaissance and weaponization activities performed
by the attacker. The last one is the actual execution of the attack pattern.

#### Explore

In order to collect information the attacker places a synthetic DNA order with
the targeted providers. During the production of the DNA and its delivery the
attacker inspects the provider’s website pages related to the order including
progress and quality reports, for all information concerning the specific DNA
sequence ordered. When the attack objective is the injection of select agents
or toxins, the attacker identifies suitable short malicious DNA sequences that
can be successfully obfuscated, i.e. sequences for which camouflage genes can
be found in common NCBI databases using BLAST. This activity is similar to the
evaluation of SoCO2 described in Section 3.3.

In order to better target the attack, an adversary may use his malware (a
trojan plugin) to monitor the DNA orders of the victims, infer the target
organism from the most common codons in the orders, and tailor the obfuscated
DNA to the organism used by the victim in his experiments.

#### Experiment

The attacker may test the DNA injection technique by placing additional orders
replacing the submitted DNA with another legitimate DNA. Further, the attacker
experiments with the providers, placing small fragments of obfuscated SoCs
within his orders. Such orders may be placed with multiple providers in order
to better target the attack. Detection of a SoC results in the order being
cancelled due to biosecurity concerns. But this does not prevent the attacker
from placing additional legitimate orders, up to some number of repeated
violations, in accordance with the client screening guidance and internal
company policies. As a result, during this phase an attacker will start with
the shortest SoC fragments gradually increasing their length.

#### Exploit

The attacker injects obfuscated malicious DNA into the orders of biologist
victims.

Please refer to Appendices A and B for an example instance of this attack and
sufficient DIY biology instrumentation.

###  4.5 Possible attack impacts

#### Biosecurity exploration

Customer screening and information sharing among synthetic DNA providers may
limit the ability of the attacker to experiment with actual DNA orders. The
attacker may circumvent customer screening by injecting obfuscated malicious
DNA into orders placed by the biologist victims. Orders whose production was
completed indicate that the obfuscated SoC successfully bypassed the
provider’s screening.

#### Biosafety violation

Similar to cyberphysical attacks here the attack results an actual toxic
substance handled by an actual person. For example, conotoxins are short
peptides many of which are less than 30 amino acids long, i.e. encoded by less
than 90bp DNA. They are found within the venom naturally produced by cone
snails and can cause serious injury if inhaled, ingested, or even absorbed
through skin. Working with conotoxins in a biological lab requires biosafety
level 2 [14], a level at which personnel must be properly trained in handling
pathogenic agents and decontamination. Biological grade bacteria such as
E.Coli DH5a are safe even if inhaled, digested, or contact skin. However,
conotoxins produced by such a bacteria are released when the bacteria is
destroyed by the human immune system or simply when transferred from one plate
to another. E.Coli is capable of producing custom complex protein at levels
higher than $1mg/mL$ [7]. A lethal dose of conotoxins is $DL50=5\mu g/Kg$ [56]
making $0.5mL$ of a conotoxin producing E.Coli dangerous to a human weighting
$100kg$.

#### Denial of service

The attacker may significantly slow down experiments by replacing one
nucleotide. Consider an angry developer that adds a rogue jump command after
the 200th character in source code of some C program. He can cause huge
headache to his coworkers. Now imagine that you can only use print debug with
at most 3-4 print commands and every program execution takes 2-3 days.
Debugging DNA is much harder than debugging electronic hardware. This variant
of the attack is likely to target large biological labs rather than DIY
biologists. A possible goal of an attacker would be to gain competitive
advantage by slowing the progress of labs developing similar biological
systems.

###  4.6 Mitigation

The digital parts of the DNA injection attack can be mitigated by additional
levels of integrity control. First, all reports sent during and after DNA
production should be password protected following best practices of paperless
communication in the banking and insurance domains. Second, a hard-copy of the
quality report including the DNA sequence should be delivered with the tube
containing the synthetic DNA. Finally, a sticker on the tube indicating the
most important information from the security perspective would be highly
valuable; for example, are there gRNA scaffolds or Cas9 encoding genes within
the tube?

At the level of biosecurity, the hardened DNA screening method based on GED
that we present in this article accurately identifies obfuscated malicious
DNA.

At the biological level, any use of Cas9 should be considered a critical stage
in the biological protocol. A security-aware biologist should use existing
methods to inhibit the expression of Cas9 within the cells [8]. Currently such
methods are used only to achieve the desired biological effects, but not as
safety or security measures.

##  5 Conclusions

In this paper we demonstrated a potential attack where a remote attacker
injects malicious DNA that produces a dangerous substance into the workflow of
a biologist victim. We demonstrated a new obfuscation technique that
circumvents current synthetic DNA screening guidelines by utilizing gene
editing using CRISPR-Cas9 for decoding of the obfuscated DNA. Experiments
demonstrate that 16 out of 50 obfuscated DNA samples are not detected when
screened according to the HHS guidelines. We further proposed a hardened
screening algorithm termed Gene Edit Distance (GED) that successfully detects
all obfuscated DNA samples. Future enhancements to DNA screening may rely on
machine learning for sequence analysis and DNA function prediction.
Adversarial learning techniques can be used to further increase the resilience
of screening algorithms against malicious DNA sequences that are not yet on
the SoC list.

The DNA injection attack discussed in this paper demonstrates a significant
new threat of malicious code altering biological processes. Although simpler
attacks that may harm biological experiments exist, we’ve chosen to
demonstrate the a scenario that makes use of multiple weaknesses at three
levels of the bioengineering workflow: software, biosecurity screening, and
biological protocols. This scenario highlights the opportunities for applying
cybersecurity know-how in new contexts such as biosecurity and gene coding.

A conceptual attack where malicious DNA exploits a vulnerability in a DNA
sequencing machine propagating to cyberspace was presented in USENIX
Security’17 [47]. Current work closes the loop by showing that code may
propagate from cyberspace to DNA. Future cyberbiological attacks may directly
exploit desktop DNA assembly machines, diminishing the border between digital
and biological.

DNA screening is not globally enforced yet. So, if a bioterrorist would like
to buy dangerous synthetic DNA today it is possible to do so, although only
outside of California [58]. Current article is timely since it will cause any
immediate harm, but hopefully, it sets the stage for robust adversary-
resilient sequence screening and cybersecurity-hardened synthetic gene
production services for the time when biosecurity screening will be enforced
by local regulation around the world.

### Ethics and responsible disclosure

This paper comes at a time when dangerous DNA can still be purchased online
without screening. It’s vital to preemptively enlist cybersecurity specialists
for reviewing and hardening biosecurity protocols. The defense-evasion
technique was disclosed to the IGSC consortium during their monthly meeting
and multiple partners expressed their interest in internal evaluation of the
benchmark data. The results of this evaluation are not yet available and their
publication depends on the goodwill of the involved companies.

### Availability

We will make all the code and the benchmark data set publicly available
following feedback from IGSC.

### Acknowledgments

Blinded.

## References

  * [1] Laura Adam, Michael Kozar, Gaelle Letort, Olivier Mirat, Arunima Srivastava, Tyler Stewart, Mandy L Wilson, and Jean Peccoud.  Strengths and limitations of the federal guidance on synthetic dna.  Nature biotechnology, 29(3):208, 2011.
  * [2] Dreycey Albin, Dan Nasko, RA Leo Elworth, Jacob Lu, Advait Balaji, Christian Diaz, Nidhi Shah, Jeremy Selengut, Chris Hulme-Lowe, Pravin Muthu, et al.  Seqscreen: a biocuration platform for robust taxonomic and biological process characterization of nucleic acid sequences of interest.  In 2019 IEEE International Conference on Bioinformatics and Biomedicine (BIBM), pages 1729–1736. IEEE, 2019.
  * [3] Stephen F Altschul, Warren Gish, Webb Miller, Eugene W Myers, and David J Lipman.  Basic local alignment search tool.  Journal of molecular biology, 215(3):403–410, 1990.
  * [4] Stephen F Altschul, Thomas L Madden, Alejandro A Schäffer, Jinghui Zhang, Zheng Zhang, Webb Miller, and David J Lipman.  Gapped blast and psi-blast: a new generation of protein database search programs.  Nucleic acids research, 25(17):3389–3402, 1997.
  * [5] Dennis A Benson, Mark Cavanaugh, Karen Clark, Ilene Karsch-Mizrachi, David J Lipman, James Ostell, and Eric W Sayers.  Genbank.  Nucleic acids research, 41(D1):D36–D42, 2012.
  * [6] Hubert Bernauer, Jason Christopher, Werner Deininger, Markus Fischer, Philip Habermeier, Klaus Heumann, Stephen Maurer, Heinz Schwer, Peer Stähler, and Tobias Wagner.  Technical solutions for biosecurity in synthetic biology.  Industry Association Synthetic Biology, Munich, Germany, 2008.
  * [7] Leading Biology.  Protein Expression in E coli.  https://www.leadingbiology.com/article-894.html, 2018.
  * [8] Felix Bubeck, Mareike D Hoffmann, Zander Harteveld, Sabine Aschenbrenner, Andreas Bietz, Max C Waldhauer, Kathleen Börner, Julia Fakhiri, Carolin Schmelas, Laura Dietz, et al.  Engineered anti-crispr proteins for optogenetic control of crispr–cas9.  Nature methods, 15(11):924, 2018.
  * [9] Jyl Burgener and Midwest Area Biosafety Network.  Understanding toxins.
  * [10] Robert Carlson.  The changing economics of dna synthesis.  Nature biotechnology, 27(12):1091, 2009.
  * [11] Sarah R Carter and Robert M Friedman.  Dna synthesis and biosecurity: lessons learned and options for the future.  J Craig Venter Institute, La Jolla, CA, 2015.
  * [12] Jacob Caswell, Jason D Gans, Nicholas Generous, Corey M Hudson, Eric Merkley, Curtis Johnson, Christopher Oehmen, Kristin Omberg, Emilie Purvine, Karen Taylor, et al.  Defending our public biological databases as a global critical infrastructure.  Frontiers in bioengineering and biotechnology, 7, 2019.
  * [13] Jeronimo Cello, Aniko V Paul, and Eckard Wimmer.  Chemical synthesis of poliovirus cdna: generation of infectious virus in the absence of natural template.  science, 297(5583):1016–1018, 2002.
  * [14] L Casey Chosewood and Deborah E Wilson.  Biosafety in microbiological and biomedical laboratories.  US Department of Health and Human Services, Public Health Service, Centers …, 2009.
  * [15] International Gene Synthesis Consortium.  Harmonized screening protocol v2.0.  https://genesynthesisconsortium.org/wp-content/uploads/IGSCHarmonizedProtocol11-21-17.pdf, 2017\.
  * [16] UniProt Consortium.  Uniprot: a worldwide hub of protein knowledge.  Nucleic acids research, 47(D1):D506–D515, 2019.
  * [17] Yingbo Cui, Jiaming Xu, Minxia Cheng, Xiangke Liao, and Shaoliang Peng.  Review of crispr/cas9 sgrna design tools.  Interdisciplinary Sciences: Computational Life Sciences, 10(2):455–465, 2018.
  * [18] Michael J Czar, Yizhi Cai, and Jean Peccoud.  Writing dna with genocad™.  Nucleic acids research, 37(suppl_2):W40–W47, 2009.
  * [19] Diane DiEuliis, Sarah R Carter, and Gigi Kwik Gronvall.  Options for synthetic dna order screening, revisited.  mSphere, 2(4):e00319–17, 2017.
  * [20] James Diggans and Emily Leproust.  Next steps for access to safe, secure dna synthesis.  Frontiers in bioengineering and biotechnology, 7:86, 2019.
  * [21] RA Leo Elworth, Christian Diaz, Jing Yang, Paul de Figueiredo, Krista Ternus, and Todd Treangen.  Synthetic dna and biosecurity: Nuances of predicting pathogenicity and the impetus for novel computational approaches for screening oligonucleotides.  PLoS Pathogens, 16(8):e1008649, 2020.
  * [22] Iliya Fayans, Yair Motro, Lior Rokach, Yossi Oren, and Jacob Moran-Gilad.  Cyber security threats in the microbial genomics era: implications for public health.  Eurosurveillance, 25(6):1900574, 2020.
  * [23] Daniel G Gibson, Lei Young, Ray-Yuan Chuang, J Craig Venter, Clyde A Hutchison III, and Hamilton O Smith.  Enzymatic assembly of dna molecules up to several hundred kilobases.  Nature methods, 6(5):343, 2009.
  * [24] Gigi Kwik Gronvall.  Synthetic biology: Biosecurity and biosafety implications.  In Defense Against Biological Attacks, pages 225–232. Springer, 2019.
  * [25] D Grushkin, T Kuiken, and P Millet.  Seven myths & realities about do-it-yourself biology. synbio 5. wilson center & synthetic biology project, 2013.
  * [26] Chi-Ruei Huang and Szecheng J Lo.  Evolution and diversity of the human hepatitis d virus genome.  Advances in Bioinformatics, 2010, 2010.
  * [27] Zhicong Huang, Erman Ayday, Jacques Fellay, Jean-Pierre Hubaux, and Ari Juels.  Genoguard: Protecting genomic data against brute-force attacks.  In 2015 IEEE Symposium on Security and Privacy, pages 447–462. IEEE, 2015.
  * [28] LIU Hui, LIU Chang, Yu-hang ZHAO, Xue-jie HAN, Zheng-wei ZHOU, WANG Chen, Rong-feng LI, and Xue-ling LI.  Comparing successful gene knock-in efficiencies of crispr/cas9 with zfns and talens gene editing systems in bovine and dairy goat fetal fibroblasts.  Journal of integrative agriculture, 17(2):406–414, 2018.
  * [29] International Association Synthetic Biology (IASB).  The iasb code of conduct for best practices in gene synthesis, 2009.
  * [30] Aashish Jain and Daisuke Kihara.  nntox: Gene ontology-based protein toxicity prediction using neural network.  Scientific reports, 9(1):1–10, 2019.
  * [31] Philip Jones, David Binns, Hsin-Yu Chang, Matthew Fraser, Weizhong Li, Craig McAnulla, Hamish McWilliam, John Maslen, Alex Mitchell, Gift Nuka, et al.  Interproscan 5: genome-scale protein function classification.  Bioinformatics, 30(9):1236–1240, 2014.
  * [32] Robert Jones.  Sequence screening.  In GL Epstein MS Garfinkel, D Endy and RM Friedman, editors, Working Papers for Synthetic Genomics: Risks and Benefits for Science and Society, pages 1–16. 2007.
  * [33] ICEBRG Justin Warner.  Man in the browser.  In MITRE ATT&CK, number T1185. The MITRE Corporation.
  * [34] Joanne Kamens.  The addgene repository: an international nonprofit plasmid and data resource.  Nucleic Acids Research, 43:1152–1157, 2015.
  * [35] James DR Knight, Payman Samavarchi-Tehrani, Mike Tyers, and Anne-Claude Gingras.  Gene information extension (gix): effortless retrieval of gene product information on any website.  Nature Methods, 16(8):665–666, 2019.
  * [36] Gregory D Koblentz.  The de novo synthesis of horsepox virus: implications for biosecurity and recommendations for preventing the reemergence of smallpox.  Health security, 15(6):620–628, 2017.
  * [37] Amanda Kobokovich, Rachel West, Michael Montague, Tom Inglesby, and Gigi Kwik Gronvall.  Strengthening security for gene synthesis:recommendations for governance.  Health Security, 17(6), 2019.
  * [38] Moshe Kravchik and Asaf Shabtai.  Detecting cyber attacks in industrial control systems using convolutional neural networks.  In Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, pages 72–83, 2018.
  * [39] Maxat Kulmanov, Mohammed Asif Khan, and Robert Hoehndorf.  Deepgo: predicting protein functions from sequence and interactions using a deep ontology-aware classifier.  Bioinformatics, 34(4):660–668, 2018.
  * [40] Wakako Kumita, Kenya Sato, Yasuhiro Suzuki, Yoko Kurotaki, Takeshi Harada, Yang Zhou, Noriyuki Kishi, Kengo Sato, Atsu Aiba, Yasubumi Sakakibara, et al.  Efficient generation of knock-in/knock-out marmoset embryo via crispr/cas9 gene editing.  Scientific reports, 9(1):1–13, 2019.
  * [41] Florian Lienert, Jason J Lohmueller, Abhishek Garg, and Pamela A Silver.  Synthetic biology in mammalian cells: next generation research tools and therapeutics.  Nature reviews Molecular cell biology, 15(2):95, 2014.
  * [42] BV Lipps.  Small synthetic peptides inhibit, in mice, the lethalithy of toxins derived from animal, plant and bacteria.  Journal of Venomous Animals and Toxins, 6(1):77–86, 2000.
  * [43] Fábio Madeira, Young Mi Park, Joon Lee, Nicola Buso, Tamer Gur, Nandana Madhusoodanan, Prasad Basutkar, Adrian RN Tivey, Simon C Potter, Robert D Finn, et al.  The embl-ebi search and sequence analysis tools apis in 2019.  Nucleic acids research, 47(W1):W636–W641, 2019.
  * [44] Wlodek Mandecki, Mark A Hayden, Mary Ann Shallcross, and Elizabeth Stotland.  A totally synthetic plasmid for general cloning, gene expression and mutagenesis in escherichia coli.  Gene, 94(1):103–107, 1990.
  * [45] Sven Panke Matthias Heinemann.  Synthetic biology—putting engineering into biology.  Bioinformatics, 22(22):2790––2799, 2006.
  * [46] Yilin Mo, Tiffany Hyun-Jin Kim, Kenneth Brancik, Dona Dickinson, Heejo Lee, Adrian Perrig, and Bruno Sinopoli.  Cyber–physical security of a smart grid infrastructure.  Proceedings of the IEEE, 100(1):195–209, 2011.
  * [47] Peter Ney, Karl Koscher, Lee Organick, Luis Ceze, and Tadayoshi Kohno.  Computer security, privacy, and $\\{$DNA$\\}$ sequencing: Compromising computers with synthesized $\\{$DNA$\\}$, privacy leaks, and more.  In 26th $\\{$USENIX$\\}$ Security Symposium ($\\{$USENIX$\\}$ Security 17), pages 765–779, 2017.
  * [48] The Odin.  The crispr cas9 bacterial genomic editting kit.  https://tinyurl.com/diycrispr (accessed Oct. 15 2020), 2020.
  * [49] Department of Health and Human Services.  Screening framework guidance for providers of synthetic double-stranded dna.  https://www.phe.gov/Preparedness/legal/guidance/syndna/Documents/syndna-guidance.pdf, 2010\.
  * [50] National Academies of Sciences Engineering, Medicine, et al.  Biodefense in the age of synthetic biology.  National Academies Press, 2018.
  * [51] C Pohl, JAKW Kiel, AJM Driessen, RAL Bovenberg, and Y Nygard.  Crispr/cas9 based genome editing of penicillium chrysogenum.  ACS synthetic biology, 5(7):754–764, 2016.
  * [52] Babak Bashari Rad, Maslin Masrom, and Suhaimi Ibrahim.  Camouflage in malware: from encryption to metamorphism.  International Journal of Computer Science and Network Security, 12(8):74–83, 2012.
  * [53] Bret Jordan Rich Piazza, John Wunder.  STIX™ Version 2.0. Part 1: STIX Core Concepts.  OASIS Committee Specification 01, 2017.  http://docs.oasis-open.org/cti/stix/v2.0/stix-v2.0-part1-stix-core.html.
  * [54] Julie D Thompson.  Introducing variable gap penalties to sequence alignment in linear space.  Bioinformatics, 11(2):181–186, 1995.
  * [55] Jonathan B Tucker.  Double-edged dna: preventing the misuse of gene synthesis.  Issues in Science and Technology, 26(3):23–32, 2010.
  * [56] Vaccinia Virus VV.  Biological agent reference sheet.  Cell, 404:275–0963.
  * [57] Liren Wang, Yanjiao Shao, Yuting Guan, Liang Li, Lijuan Wu, Fangrui Chen, Meizhen Liu, Huaqing Chen, Yanlin Ma, Xueyun Ma, et al.  Large genomic fragment deletion and functional gene cassette knock-in via cas9 protein mediated genome editing in one-cell rodent embryos.  Scientific reports, 5:17517, 2015.
  * [58] Rachel West and Gigi Kwik Gronvall.  California shows the way for biosecurity in commercial gene synthesis.  Nature Biotechnology, pages 1–1, 2020.
  * [59] Rachel M West and Gigi Kwik Gronvall.  Crispr cautions: Biosecurity implications of gene editing.  Perspectives in Biology and Medicine, 63(1):73–92, 2020.
  * [60] Ken-ichi Yamazaki, Kim de Mora, and Kensuke Saitoh.  Biobrick-based ‘quick gene assembly’in vitro.  Synthetic Biology, 2(1):ysx003, 2017.
  * [61] Mark Yampolskiy, Wayne E King, Jacob Gatlin, Sofia Belikovetsky, Adam Brown, Anthony Skjellum, and Yuval Elovici.  Security of additive manufacturing: Attack taxonomy and survey.  Additive Manufacturing, 21:431–457, 2018.
  * [62] Fuhao Zhang, Hong Song, Min Zeng, Yaohang Li, Lukasz Kurgan, and Min Li.  Deepfunc: a deep learning framework for accurate prediction of protein functions from protein sequences and interactions.  Proteomics, 19(12):1900019, 2019.
  * [63] Zheng Zhang, Scott Schwartz, Lukas Wagner, and Webb Miller.  A greedy algorithm for aligning dna sequences.  Journal of Computational biology, 7(1-2):203–214, 2000.

##  Appendix A Example attack instance

The attack agent may be a trojan browser plugin (Figure 5 a) that provides a
useful function for biologists. Legitimate plugins, e.g. [35], are already
used by synthetic biologists. In this example the trojan plugin adds an
annotated schematic adequately visualizing DNA sequences found on the Web
pages or submitted in forms. See Figure 7 in the Appendix for an example of
such a plugin.

Figure 6: DIY biology instrumentation, including a CRISPR kit from the-
odin.com (left), and a microcentrifuge and TE buffer from eBay (right).

A DIY biologist obtains a CRISPR kit from the-odin.com (Figure 6 left). The
biologist also places an order with a DNA provider for a plasmid containing
Green Fluorescent Protein (GFP) to make the E.Coli glow.

The malicious payload of the plugin manipulates the DNA during form submission
(Figure 5 c and 3) and substitutes the DNA a user entered for a successfully
obfuscated conotoxin888An attacker would use a conotoxin with high number of
disulfide bonds to resist standard bleach which is commonly used for bacteria
disposal [9]. (Sections 3.1 4.4 and Figure 5 d). Consequently the plugin
substitutes the malicious DNA for the one the user entered in all provider’s
reports (Figure 5 c and 7). Since most gene synthesis companies charge by the
number of base pairs [10], the attacker retains the length of the originally
ordered DNA in order to avoid detection resulting from unexpected costs.

Once all orders arrive, the DIY biologist applies the protocol attached to the
CRIPSR kit [48] allowing the bacteria to survive on a plate with a Strep
antibiotic. Then he inserts the GFP plasmid, which does not glow because it
was replaced by a toxin-encoding plasmid. Frustrated, the biologist will then
dispose of the bacteria. Since the bacteria is not pathogenic, the protocol
requires simply putting 5% bleach on the plate and putting the plate in the
trash [48]. However, some conotoxins resist bleach and disposing of them in
this way may release the toxins to the air and potentially cause serious
injury.

##  Appendix B DIY biology instrumentation

We note the wide applicability of the DNA injection threat in terms of
biological instrumentation. Everything that is required for a DIY biology
enthusiast to develop her own genes and apply them to cells is available for
purchase online. Moreover, no special expertise or sophisticated equipment is
required. For instance, the DIY Bacterial Gene Engineering CRISPR Kit can be
purchased from the-odin.com (Figure 6 left). The kit contains E. coli cells
(that were stripped of any pathogens and are considered safe), Cas9 coding
plasmids, growth media, petri plates, and other instrumentation, including
detailed instructions on the CRISPR protocol. When a plasmid (such as in
Figure 1.g) is ordered online, it comes in a dry form and needs to be
resuspended in a TE buffer, which is a commonly-used buffer solution. Most
resuspension protocols suggest centrifuging the synthetic DNA upon receipt,
and the required microcentrifuge and TE buffer are available for purchase on
eBay (Figure 6 right).

##  Appendix C Level 1 SoC Obfuscation (SoCO1)

As an implementation of the HHS guidelines, the designers of GenoTHREAT [1]
chose to split the query sequence into consecutive 200bp fragments rather than
using a sliding window of 200bp. This is much more efficient in terms of the
number of BLAST queries. Yet, such a design is also susceptible to short DNA
inserts. According to GenoTHREAT an alignment between the query sequence and a
target sequence is a _Best Match_ if $QC=100\%$ and $PI$ is the maximal over
all other alignments of the query sequence. Note that more than one alignment
may match these conditions. Further, if either the beginning or end of a 200bp
fragment is aligned to a SoC and $QC>50\%$, then the fragment is extended in
order to identify a possible alignment of the preceding or the following
fragment, with a SoC.

Next we discuss the simplest DNA obfuscation method which is specifically
targeted at circumventing GenoTHREAT. We will refer to this method as Level 1
Sequence of Concern Obfuscation (SoCO1). In Section 3.1 we generalize this
approach to withstand arbitrary _Best Match_ screening.

The pseudocode of SoCO1 is presented in Algorithm 3.

In order to hide a sequence of concern (SoC) from GenoTHREAT, we split it into
small fragments (${SoC}=f_{1}+\ldots+f_{n}$) of 154bp each, padded with NSoC
fillers. Plus $+$ denotes string concatenation.

Similar to the old well-known encrypted or oligomorphic malware [52], building
the decoder is the most challenging part in designing obfuscated malicious
DNA. Here the decoder should operate within living cells rather than in
cyberspace. In general, the decoder needs to perform two tasks when
reconstructing the malicious DNA: (1) it should cut out the NSoC fillers
between the SoC fragments, and (2) it should stitch the SoC fragments forming
operational DNA.

We use $m+m_{RC}$ (Equations 2 and 3) as the NSoC fillers between SoC
fragments ($f_{i}$), such that the length of $m_{RC}+f_{i}+m$ is exactly
200bp. The DNA code block $f_{1}+m+m_{RC}+f_{2}+\ldots+m_{RC}+f_{n}$ is not
detected by GenoTHREAT as a SoC even if SoC exists within the SoC database,
because there are no best matches with a query coverage of 100%. We show how
GTP mitigates this problem in Section 3.3. We assume that Cas9 protein is
available within the cells. The decoder block of the malicious DNA should
contain the gRNA scaffold targeting $m$ in order to form a CRISPR system that
will cut out $m+m_{RC}$ between consecutive SoC fragments ($f_{i}\text{\char
34}m+m_{RC}\text{\char 34}f_{i+1}$).

Next, there is a need to repair the DNA cut made by CRISPR when removing the
residue PAM nucleotides. This process is the same for both SoCO1 and SoCO2.

Overall, the malicious DNA sequence injected into an online synthetic DNA
order, should contain the split SoC, the gRNA scaffold, and a set of HDR
templates, as shown in Algorithm 3. We refer to such sequences as SoCO1
sequences. Generating SoCO1 sequences requires minimal computing time, but
they are detected easily as shown in Section 3.3. In particular, SoCO1
sequences can be detected by relaxing GenoTHREAT ’s 100% query coverage
constraint and returning a hit if a sequence with the highest score is a SoC.

Input: $P$ – a Sequence of Concern

Output: $O$ – an obfuscated Sequence of Concern

/* @post-condition: Expressing $O$ in Cas9 containing environment results in
assembly of $P$ */

1

2Partition $P$ into 154bp fragments $P=p_{1}+p_{2}+\ldots+p_{n}$

3 Let $r$ be a promoter and a ribosome binding site

4 Let $t$ be a terminator

5 Let $f$ be a 23bp long efficient Cas9 cutting site [17]

6 $f_{RC}\leftarrow$ reverse complement of $F$

7 $body_{1}\leftarrow r+p_{1}+f$

8 $\forall_{i=2}^{n-1}body_{i}\leftarrow f_{RC}+p_{i}+f$

9 $body_{n}\leftarrow f_{RC}+p_{n}+t$

10 $Body\leftarrow
r+p_{1}+f+\left(\sum_{i=2}^{n-1}f_{RC}+p_{i}+f\right)+f_{RC}+p_{n}+t$

11 Let $grs$ be a gRNA scaffold targeting $f$

// $grs$ also targets $f_{RC}$ on the opposite strand.

12 for  _each $p_{i},p_{i+1}$_ do

13 $hdr_{i}\leftarrow$32bp suffix of $p_{i}+$ 32bp prefix of $p_{i+1}$

14Let $nonce$ be a 40bp long DNA sequence, which does not contain $f$ or
$f_{RC}$

15 $Decoder\leftarrow nonce+grs+hdr_{1}+nonce+\ldots+hdr_{n-1}$

// Assemble and return the obfuscated sequence

return _$osoc=Body+Decoder$_

Algorithm 3 SoC Obfuscation 1 (SoCO1) Figure 7: Sample trojan plugin.
Synthetic DNA order form (a). A browser plugin (b) that adds a visualization
of DNA sequences within form text fields (c). Code snippet of a malicious
payload replacing the submitted DNA order with predefined attack DNA (d).
Figure 8:  Excerpts from alignment reports generated using BLASTX [4] for the
obfuscated $\alpha$-conotoxin PeIA. (a) The alignment domains for 29
alignments to 10 target sequences specific to the conus family, a species that
produces $\alpha$-conotoxin PeIA. (b) The images (as defined in Section 2.2)
of three alignments to the $\alpha$-conotoxin PeIA peptide. The alignments are
arranged according to the image start positions, and the respective domain
ranges appear in braces [..] at the alignments’ ends. The alignment markers
$\alpha_{1}$,$\alpha_{2}$,$\alpha_{3}$ and the domain ranges were added to the
NCBI report. The scores of the three alignments range from 47.3 to 54.6. (c) A
2D plot presenting the alignments between obfuscated and non-obfuscated
$\alpha$-conotoxin PeIA, found by Blast 2 sequences [63]. The x-axis
represents the obfuscated DNA, and the y-axis represents the DNA that encodes
$\alpha$-conotoxin PeIA. The red and blue lines represent extended alignments,
with zero penalties for long gaps in the target sequence (deletion). (d)
Alignments of the unified domains of $\alpha_{1}$ and $\alpha_{3}$ with their
unified images. Two local alignments found by Blast 2 sequences are
successfully merged into a cleaned alignment with 100 Percent Identity.