DNAShell : Iran based attackers utilize a DNA sequencer exploit for genetic information theft.
Introduction
A popular saying is "You can change all your banking passwords, your credit card numbers,but not your DNA". Being a unique attribute for each individual, this genetic material theft can then be used for purposes such as establishing paternity, proving genealogical connections or even unmasking private medical conditions.
We observed a case where attacks originating from Iran are trying to use an exploit in a popular DNA sequencing LIMS software to bind a shell.
About the attack
From June 12 - 14, we saw regular attacks from 2.176.78.42 , an IP located in Iran, utilizing CVE-2017-6526, an issue in dnaTools dnaLIMS 4-2015s13. According to dnatools.com, dnaLIMS™ is a Web based bioinformatics LIMS that provides scientists and researches with
hardware independent software tools for processing and managing DNA sequencing requests."
The tool is popular and is used by various institutions. A simple google dork leads us to some login portals of dnaLIMS :
Attack code
The attack code is a POST request to cgi-bin/dna/sysAdmin.cgi as shown below :
The above script can be broken down into two basic parts. The first part iterates through all the environment variables. This is used to find /bin/bash or any other shell that a Unix system would be using. The code below is a safe implementation that can be used to show that it will infect find /bin/bash on a Linux system.
The second part will then take this variable, make a new raw socket that listens on port 11831 and then pass any command sent through the socket to the variable, which in this case is /bin/bash. Hence a bind shell is established.
Conclusion
The exact motives of the attacker(s) is unknown. Unlike an IPCamera or Router based IoT device, these are very unique devices installed in scientific ,academic and medical institutions. As a result,the number of such devices is not very high and might not help greatly in DDoS.
However, successful exploitation and DNA theft in specific cases can be fruitful. Either it can be sold in black market, or a high profile attacker can actually be looking for a specific persons' data.
We are not aware of a patch for this bug. In fact, when we had a look at the original disclosure by ShoreBreakSecurity, we saw a funny disclosure response by the vendor,indicating they don't take DNA theft seriously.
Be careful when you share your DNA with a third party. Its' your hash!
Authors :
I appreciate the idea of using modern technology to make services more accessible to women. The Pink Saheli Smart Card could potentially provide a convenient way for eligible beneficiaries to access associated facilities. The initiative would benefit from clear awareness campaigns explaining who can apply and how the system works. It is also important to offer support when users face difficulties. A combination of technology, human assistance, and transparent information can make the system more inclusive and easier to use.
I tried diu win login game login but the page was taking time to load. Is this a common issue during busy hours, or does it depend on internet connection? If anyone knows, please reply.
Can someone explain diuwin game colour prediction in a simple way? I’ve seen people talk about patterns, but I’m not sure if there is any fixed method or if results are random. Please share your thoughts.
I’m having a small confusion with diu win lottery login. Does it require OTP verification every time, or only during the first login? Also, what should we do if OTP doesn’t arrive on time?
I’m seeing diuwin login mentioned in a few places, so I wanted to check it out. Before using it regularly, can anyone confirm if it works properly on Android devices and whether it requires any verification