Flaws in Illumina DNA Sequencer Devices Allows Hacks

Vulnerabilities in a human gene sequencer made by Illumina could allow hackers to overwrite system firmware to brick the device – rendering it unusable – or install a malicious firmware implant for ongoing attacker persistence.

See Also: Frost Radar™ on Healthcare IoT Security in the United States

Researchers at Eclypsium said Tuesday the Illumina iSeq 100 – “the most affordable, compact benchtop sequencing system in the Illumina portfolio,” according to the device maker – could be converted into a tool for faking DNA research or manipulating medical research.

Popular DNA sequencing services and medical labs rely on devices made by manufacturers such as Illumina. Analysis of the iSeq 100 model shows reliance on obsolete commodity hardware, despite its cutting-edge application.

“Sadly these kinds of issues are very common in advanced medical and research devices such as DNA sequencers since they regularly use old x86-based industrial computer boards – SBC – Single Board Computers – that are designed to work for decades but receive little to no firmware security updates,” said Alex Bazhaniuk, CTO of Eclypsium.

The most impactful security worry is that an attacker could gain persistence on a system and do so at a level far below the operating system, he said. Attackers prize exploitable flaws in firmware known as BIOS/UEFI that initializes devices since malware loaded before the operating system takes over is difficult to detect and often impossible to eradicate without the difficult step of reflashing the firmware.

“By doing so, the attacker has the ability to potentially manipulate and control everything that the software on the system does. In this case, manipulate the DNA results received from the DNA sequencing hardware that is part of the device, or in another scenario manipulate the DNA data as it is stored on disk by the software,” Bazhaniuk told Information Security Media Group.

He said Eclypsium notified Illumina about the findings and that the device maker issued a patch.

Illumina in a statement said it “appreciates” Eclypsium research’s report and its shared commitment to the coordinated vulnerability disclosure principles. “We are following our standard processes and will notify impacted customers if any mitigations are required. Our initial evaluation indicates these issues are not high-risk,” the statement said.

Researchers found the iSeq 100 using “a very outdated” implementation of boot-up firmware. Specifically, the device uses an implementation of BIOS from 2018, which attackers could force the device into using by turning on Compatibility Support Mode, a firmware module used to support legacy applications. “While this maintains support for old devices that can’t be upgraded, it is not recommended for newer high-value assets,” Eclypsium said.

The BIOS version that Illumina chose for the device has known vulnerabilities. It doesn’t support Secure Boot, a specification for ensuring that only trusted software can load before the operating system takes over. Researchers additionally found the device lacks basic read/write protections, meaning that an attacker could modify the firmware.

Eclypsium researchers have not seen evidence of the iSeq 100 firmware being exploited in the wild. “On the other hand, unprotected implementations of BIOS/UEFI have been repeatedly exploited in more traditional devices such as laptops for almost a decade.”

That includes other previous malicious UEFI firmware implants over the last several years, such as LoJax and MosaicRegressor (see: Hacking Group Used Rare UEFI Bootkit for Espionage).

“Over the past decade, the state of the BIOS/UEFI security landscape has changed considerably,” Eclypsium said. “State-based attackers and ransomware operators have pivoted en masse to target firmware both in the supply chain as well as devices already in the field,”

In response, technology vendors – including the makers of motherboards, chipsets and operating systems – have added layers of security protections aimed at keeping critical code safe. “In spite of these efforts, firmware attacks have continued to grow. “

“Device manufacturers focus on their own vertical for the software and cloud infrastructure of their product and abandon the hardware once development is done – except for rare cases like CPU vulnerabilities where every vendor performs updates due to the high profile of the issues,” Bazhaniuk said.

This is not the first time vulnerabilities have been identified in Illumina devices. Vulnerabilities affecting Illumina’s Universal Copy Service software contained in several of the company’s genetic testing gear – including the iSeq 100 – were the subject of alerts by the U.S. Food and Drug Administration and Cybersecurity and Infrastructure Security Agency in 2023 (see: Illumina, Feds Say Genetic Testing Gear at Risk for Hacking).

The latest vulnerabilities that Eclypsium identified are unrelated to the 2023 set that the FDA and CISA warned about, Bazhaniuk said.

“Healthcare organizations must check for current firmware protections in their equipment, and if any gaps are found, demand the vendor fix them and issue updates,” Bazhaniuk said.

“This speaks to a broader supply chain issue that we continue to see across all industries – a manufacturer starts the supply chain by making a motherboard with UEFI firmware, then sells that to Illumina, who then integrates it into their product,” he said.

“If vulnerabilities show up in the motherboard, the vendor does a firmware update but Illumina does not push these updates down the supply chain.”