- Eclypsium researchers find vulnerability in the way the iSeq 100 boots up
- The flaw allows threat actors to establish persistence, brick the device, or manipulate the results
- A patch has since been made available, so update now
A popular DNA sequencer has been found with a vulnerability that allows threat actors to establish persistence on the device, destroy the hardware or even tamper with the results, experts have claimed.
Researchers from Eclypsium analyzed the BIOS firmware in the iSeq 100, a DNA sequencer built by US biotechnology company Illumina, a benchtop sequencing system designed for small genomic and targeted sequencing applications. It is used to read and analyze DNA, help scientists understand genetic information, study diseases, develop treatments or explore how organisms are related.
Eclypsium said the device boots an older version of the BIOS firmware, which even ran in Compatibility Support Mode (CSM), to support older devices. It did not start with standard protection, including Secure Boot technology.
Manipulation of results
All of this left the iSeq 100 vulnerable to nine different bugs, some discovered in 2017, and with varying degrees of severity. Threat actors could launch LogoFAIL, Specter 2 and Microarchitectural Data Sampling (MDS) attacks against these devices, it was claimed.
To make matters worse, Eclypsium said that it only analyzed this specific model and that it is possible that other models also suffer from the same drawbacks, especially since the motherboards in these devices were built by a third party.
“If the data is manipulated by an implant/backdoor in these devices, then a threat actor can manipulate a wide range of outcomes, including false presence or absence of hereditary conditions, manipulation of medical treatments or new vaccines, false lineage DNA research, etc. Eclypsium said.
Since the discovery, Eclypsium has notified the iSeq 100 manufacturer, who came back with a patch. There was no word on how many devices are vulnerable or how quickly the patch will be applied to all of them.
“Our initial evaluation indicates that these issues are not high risk,” an Illumina representative told us Bleeping Computer.
Via Bleeping Computer
