Thermo Fisher Flaw Lets Attackers Secretly Alter DNA Analysis Data

Thermo Fisher Scientific has released security patches for a high-severity vulnerability impacting Applied Biosystems’ DNA-analysis workflows. According to Thermo Fisher’s bulletin, .fsa and .hid output files can be tampered with in ways that are nearly undetectable before forensic interpretation software runs, if existing controls are bypassed.

Affected Products and Patches Product Vulnerable Version Fixed Version 3500/3500xL Series Data Collection Software 4.0.2 and earlier 4.0.3 3730/3730xL Series Data Collection Software 5.0.2 and earlier 5.0.3 SeqStudio Genetic Analyzer Data Collection Software 1.2.5 and earlier 1.2.6 SeqStudio Flex Series Instrument Software 1.2.0 and earlier 1.2.1 GeneMapper ID-X Software v1.7.3 and earlier v1.7.4 Available fixes are now available for the affected products: 3500/3500xL Series Data Collection Software, 3730/3730xL Series Data Collection Software, SeqStudio Genetic Analyzer Data Collection Software, SeqStudio Flex Series Instrument Software, and GeneMapper ID-X Software. Three legacy data-collection products, including 3130 Series, ABI PRISM 3100/3100-Avant, and ABI PRISM 310, have reached end of life.

For unpatched environments, Thermo Fisher recommends layered controls: store generated files in encrypted storage, restrict file permissions, and limit internet connectivity to trusted sources through firewall policies. Security teams should also separate instrument networks, apply least privilege to laboratory shares, monitor file-write events, and retain auditable logs for data movement and access.