By Richard Forno, assistant director, UMBC Center for Cybersecurity, director, cybersecurity graduate program

The people of Baltimore are beginning their fifth week under an electronic siege that has prevented residents from obtaining building permits and business licenses – and even buying or selling homes. A year after hackers disrupted the city’s emergency services dispatch system, city workers throughout the city are unable to, among other things, use their government email accounts or conduct routine city business.

In this attack, a type of malicious software called ransomware has encrypted key files, rendering them unusable until the city pays the unknown attackers 13 bitcoin, or about US$76,280. But even if the city were to pay up, there is no guarantee that its files would all be recovered; many ransomware attacks end with the data lost, whether the ransom is paid or not.

Similar attacks in recent years have crippled the United Kingdom’s National Health Service, shipping giant Maersk and local, county and state governments across the U.S. and Canada. Map: The Conversation, CC-BY-ND Source: Recorded Future: Get the data

These types of attacks are becoming more frequent and gaining more media attention. Speaking as a career cybersecurity professional, the technical aspects of incidents like this are but one part of a much bigger picture. Every user of technology must consider not only threats and vulnerabilities, but also operational processes, potential points of failure and how they use technology on a daily basis. Thinking ahead, and taking protective steps, can help reduce the effects of cybersecurity incidents on both individuals and organizations.

Understanding cyberattack tools

Software designed to attack other computers is nothing new. Nations, private companies, individual researchers and criminals continue developing these types of programs, for a wide range of purposes, including digital warfare and intelligence gathering, as well as extortion by ransomware.

Many malware efforts begin as a normal and crucial function of cybersecurity: identifying software and hardware vulnerabilities that could be exploited by an attacker. Security researchers then work to close that vulnerability. By contrast, malware developers, criminal or otherwise, will figure out how to get through that opening undetected, to explore and potentially wreak havoc in a target’s systems.

Sometimes a single weakness is enough to give an intruder the access they want. But other times attackers will use multiple vulnerabilities in combination to infiltrate a system, take control, steal data and modify or delete information – while trying to hide any evidence of their activity from security programs and personnel. The challenge is so great that artificial intelligence and machine learning systems are now also being incorporated to help with cybersecurity activities.

There’s some question about the role the federal government may have played in this situation, because one of the hacking tools the attackers reportedly used in Baltimore was developed by the U.S. National Security Agency, which the NSA has denied. However, hacking tools stolen from the NSA in 2017 by the hacker group Shadow Brokers were used to launch similar attacks within months of those tools being posted on the internet. Certainly, those tools should never have been stolen from the NSA – and should have been better protected.

But my views are more complicated than that: As a citizen, I recognize the NSA’s mandate to research and develop advanced tools to protect the country and fulfill its national security mission. However, like many cybersecurity professionals, I remain conflicted: When the government discovers a new technology vulnerability but doesn’t tell the maker of the affected hardware or software until after it’s used to cause havoc or disclosed by a leak, everyone is at risk.

Chart: The Conversation, CC-BY-ND Source: CyberEdge Group Cyberthreat Defense Report 2019 Get the data

Baltimore’s situation

The estimated $18 million cost of recovery in Baltimore is money the city likely doesn’t have readily available. Recent research by some of my colleagues at the University of Maryland, Baltimore County, shows that many state and local governments remain woefully underprepared and underfunded to adequately, let alone proactively, deal with cybersecurity’s many challenges.

It is concerning that the ransomware attack in Baltimore exploited a vulnerability that has been publicly known about – with an available fix – for over two years. NSA had developed an exploit (code-named EternalBlue) for this discovered security weakness but didn’t alert Microsoft about this critical security vulnerability until early 2017 – and only after the Shadow Brokers had stolen the NSA’s tool to attack it. Soon after, Microsoft issued a software security update to fix this key flaw in its Windows operating system.

Admittedly, it can be very complex to manage software updates for a large organization. But given the media coverage at the time about the unauthorized disclosure of many NSA hacking tools and the vulnerabilities they targeted, it’s unclear why Baltimore’s information technology staff didn’t ensure the city’s computers received that particular security update immediately. And while it’s not necessarily fair to blame the NSA for the Baltimore incident, it is entirely fair to say that the knowledge and techniques behind the tools of digital warfare are out in the world; we must learn to live with them and adapt accordingly.

Chart: The Conversation, CC-BY-ND Source: Recorded Future: Get the data

Compounding problems

In a global society where people, companies and governments are increasingly dependent on computers, digital weaknesses have the power to seriously disrupt or destroy everyday actions and functions.

Even trying to develop workarounds when a crisis hits can be challenging. Baltimore city employees who were blocked from using the city’s email system tried to set up free Gmail accounts to at least get some work done. But they were initially blocked by Google’s automated security systems, which identified them as potentially fraudulent.

Making matters worse, when Baltimore’s online services went down, parts of the city’s municipal phone system couldn’t handle the resulting increase in calls attempting to compensate. This underscores the need to not only focus on technology products themselves but also the policies, procedures and capabilities needed to ensure individuals and/or organizations can remain at least minimally functional when under duress, whether by cyberattack, technology failures or acts of nature.

Protecting yourself, and your livelihood

The first step to fighting a ransomware attack is to regularly back up your data – which also provides protection against hardware failures, theft and other problems. To deal with ransomware, though, it’s particularly important to keep a few versions of your backups over time – don’t just rewrite the same files on a backup drive over and over.

That’s because when you get hit, you’ll want to determine when you were infected and restore files from a backup made before that time. Otherwise, you’ll just be recovering infected data, and not actually fixing your problem. Yes, you might lose some data, but not everything – and presumably only your most recent work, which you’ll probably remember and recreate easily enough.

And of course, following some of cybersecurity’s best practices – even just the basics – can help prevent, or at least minimize, the possibility of ransomware crippling you or your organization. Doing things like running current antivirus software, keeping all software updated, using strong passwords and multifactor authentication, and not blindly trusting random devices or email attachments you encounter are just some of the steps everyone should take to be a good digital citizen.

It’s also worth making plans to work around potential failures that might befall your email provider, internet service provider and power company, not to mention the software we rely on. Whether they’re attacked or simply fail, their absence can disrupt your life.

In this way, ransomware incidents serve as an important reminder that cybersecurity is not just limited to protecting digital bits and bytes in cyberspace. Rather, it should force everyone to think broadly and holistically about their relationship with technology and the processes that govern its role and use in our lives. And, it should make people consider how they might function without parts of it at both work and home, because it’s a matter of when, not if, problems will occur.

******

Richard Forno, Senior Lecturer, Cybersecurity & Internet Researcher, University of Maryland, Baltimore County

Header image: Many of Baltimore’s city services are crippled by a cyberattack.
The Conversation from City of Baltimore and Love Silhouette/Shutterstock.com, CC BY-SA

This article is republished from The Conversation under a Creative Commons license. Read the original article.

By Sarah Stellwagen, postdoctoral researcher in biological sciences, UMBC

What do all of the over 45,000 described spider species on Earth have in common? Each makes at least one type of silk. And there are an awful lot of types out there.

An individual orb weaving spider – the kind that spins the classic two-dimensional aerial spiral webs that seem to always be suspended at human face-height – can produce seven different silks, each with unique material properties.

Dragline silk forms the frame of an orb web and is famous for its strength and toughness, comparable to that of steel. The capture spiral is made of a highly stretchy version called flagelliform silk. Orb weaving spiders use an additional type of silk to wrap prey and create web decorations.

But there’s another kind that, on the surface, doesn’t resemble silk at all: the sticky glue with which some spiders cover their silk capture threads. It doesn’t look like the classic threads that come to mind when thinking of spider silk, but the gluey substance from these webs is in fact a silk protein.

For many years, researchers have been uncovering the secrets of spider glue, which stays wet in its open air environment and sticky over many rounds of attachment and release. Its genetic blueprint has remained elusive, however, meaning scientists haven’t been able to think about setting up large-scale production of this potentially useful biomaterial.

Using new technology, my colleague and I have been able to sequence the the first full genetic sequences that code for spider glue proteins.

A silk that’s really a sticky glue

Under a microscope, orb weaver glue resembles beads on a string – little glistening spheres along a strand of stretchy support silk. Instead of being spun into a fiber as it leaves the spider’s body like other silks, the glue proteins are extruded as a jumbled mass. Their job is to stickily retain prey that get caught in the web.

Different spider species produce glue tailored to their habitat’s conditions and prey.

The glue of tropical orb weaving species is sticky in the spider’s wet habitat, but downgrades to just tacky in low humidity. The glue of orb weavers from dry regions becomes dilute and thin if the humidity is too high.

Bolas spiders forgo the orb web, and instead produce a large globule of glue at the end of a long strand of silk that they whirl rapidly through the air. The glue of this sticky snare is specialized for capturing moths covered with loose scales.

Widow spiders produce vertical, glue-covered trip lines that detach from the ground when encountered by an unsuspecting victim, springing the prey into the air where it hangs suspended. Unlike orb weaver glue, widow glue is resistant to fluctuating humidity.

These various specialized adhesive properties have intrigued biomaterials researchers who can dream up plenty of uses for artificial versions of spider glues. But without knowing the genes that code for these proteins, there hasn’t been a clear road map for how to produce synthetic spider glues.

Cracking a long, repetitive code

Surprisingly, researchers have only sequenced around 20 full-length spider silk genes despite the incredible diversity of spiders and decades-old interest in silk as a useful biomaterial.

It turns out that not only are the properties of spider silk amazing, but so is the DNA code that stores the instructions for making the protein. Spider silk genes are extremely large; in itself that’s not a problem, but the bulk of their sequence is made from repeats of the same small DNA bits.

Imagine that the sentence “THE QUICK BROWN FOX JUMPED OVER THE LAZY DOG” is a sequence of DNA that encodes for a protein, but whose exact order of letters is still unknown.

In order to discover this sequence, the main method of DNA sequencing technology available today has three main steps. Once a DNA sample is collected, many copies of the sentence are randomly broken up into small pieces. For example, you might end up with a collection of fragments like “THE QU” “QUICK B” “BROWN FO” “WN FOX J” “AZY DOG” and on and on.

Then a DNA sequencing machine discovers each letter of each piece. The final step is stitching all the short pieces, technically called “reads,” back together in one sequence to figure out the original sentence.

For the sentence above, this is an easy task. The sequence of letters is unique, and as long as there are at least five characters in each read, it’s possible to figure out where one fits relative to another.

Now imagine a similar sentence: “THE QUICK BROWN FOX JUMPS JUMPS JUMPS JUMPS JUMPS JUMPS JUMPS JUMPS JUMPS JUMPS JUMPS OVER THE LAZY DOG.” Given many random short reads from the middle region like “UMPS J” or “S JUMP,” no matter how you slice and dice, it’s impossible to use this method to figure out the number of “JUMPS” in the complete sentence.

Sequencing a long read of DNA in one go

For many years DNA sequencing has been limited to this short-read strategy: breaking a gene into bits and then reassembling into one cohesive sequence.

Setting aside some difficult and expensive techniques that are out of reach for standard labs, the best way to fully discover a long, repetitive gene is to sequence the repetitive part from start to finish in one go. Fortunately, emerging technology, while still in its infancy, is starting to allow this long-read sequencing by getting around the chemistry limitations of the short-read method. For those that study super-repetitive DNA this is excellent news: New types of DNA sequencers are finally resolving the “JUMPS.”

Now that two spider glue genes are fully sequenced, the first step towards making a synthetic version is complete. Researchers can now insert the genes into other organisms, like bacteria or yeast, to make the glue in bulk.

Unlike solid silks, the glue proteins do not have to be transformed from a liquid to a solid fiber, something spiders do effortlessly but that scientists have trouble replicating. The glue has the potential for many unique applications and is biodegradable, water soluble and stays sticky for months or even years.

Imagine safer pest control or washable filters. Or frat boys wrestling in a kiddie pool of the stuff. Either way, someday soon it might be possible to reach your hand into a bucket of spider glue – the tricky part will be not sticking to whatever you touch next.

*****

Sarah Stellwagen is a postdoctoral researcher in biological sciences at University of Maryland, Baltimore County

Header image: Spider glue is actually a specialized silk protein. Sarah Stellwagen, CC BY-ND

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Ivan Erill, Associate Professor, Biological Sciences, UMBC

Imagine a world where your odds of surviving minor surgery were one to three. A world in which a visit to the dentist could spell disaster. This is the world into which your great-grandmother was born. And if humanity loses the fight against antibiotic resistance, this is a world your grandchildren may well end up revisiting.

Antibiotics changed the world in more ways than one. They made surgery routine and childbirth safer. Intensive farming was born. For decades, antibiotics have effectively killed or stopped the growth of disease-causing bacteria. Yet it was always clear that this would be a rough fight. Bacteria breed fast, and that means that they adapt rapidly. The emergence of antibiotic resistance was predicted by none other than Sir Alexander Fleming, the discoverer of penicillin, less than a year after the first batch of penicillin was mass produced.

Yet, contrary to popular belief, antibiotic resistance did not evolve recently, or in response to our use and misuse of antibiotics in humans and animals. Antibiotic resistance first evolved millions of years ago, and in the most mundane of places.

I am a bioinformatician, and my lab studies the evolution of bacterial genomes. With antibiotic resistance becoming a major threat, I’m trying to figure out how resistance to antibiotics emerges and spreads among bacterial populations.

A billion-years-old arms race

Most antibiotics are naturally produced by bacteria living in soil. They produce these deadly chemical compounds to fend off competing species. Yet, in the long game that is evolution, competing species are unlikely to sit idly by. Any mutant capable of tolerating a minimal quantity of the antibiotic will have a survival advantage and will be selected for – over generations this will produce organisms that are highly resistant.

So it’s a foregone conclusion that antibiotic resistance, for any antibiotic researchers might ever discover, is likely already out there. Yet people keep talking about the evolution of antibiotic resistance as a recent phenomenon. Why?

Resistance can and does evolve when bacteria are persistently exposed to a new antibiotic they have never encountered. Let’s call this the old-fashioned evolutionary road. Second, when bacteria are exposed to a novel antibiotic and are in contact with bacteria already resistant to this antibiotic, it is just a matter of time before they get cozy and trade genes. And, importantly, once genes have been packaged for trading, they become easier and easier to share. Bacteria then meet other bacteria, which meet more bacteria, until one of them eventually meets you.

The rise and fall of sulfa drugs

For all their might, antibiotics are not the only substances capable of effectively killing bacteria (without killing us). A decade before the mass production of penicillin, sulfonamide drugs became the first commercial antibacterial agent. Sulfa drugs act by blocking an enzyme – called DHPS – that is essential for bacteria to grow and multiply.

Sulfa drugs are not antibiotics. No known organism produces them. They are chemotherapeutic agents synthesized by humans. No natural producer means no billion-year-old arms race and no pool of ancient resistance genes. We would expect bacteria to evolve resistance to sulfa drugs via the good old-fashioned way. And they did.

Just a few years after their commercial introduction, the first cases of resistance to sulfa drugs were reported. Mutations to the bacterial DHPS enzyme made sulfa drugs ineffective. Then penicillin and the antibiotic era came about. Sulfa drugs were relegated to a secondary role in medicine, but they gained popularity as cheap antimicrobials in animal husbandry. By the 1980s resistance to sulfa drugs was rampant and worldwide. What had happened?

At odds with resistance

To answer this question our research team took sequences of sulfa drug resistance genes from disease-causing bacteria and compared them to millions of “normal” versions of the DHPS enzyme in nonpathogenic bacteria.

The team identified two large groups of bacteria that had DHPS enzymes resistant to sulfa drugs. By studying their DNA sequences, we were able to show that these resistant DHPS enzymes had been present in these two groups of bacteria for at least 500 million years. Yet sulfa drugs were first synthesized in the 1910s. How could resistance be around 500 million years ago? And how did these resistance genes find their way into the disease-causing bacteria plaguing hospitals worldwide?

The clues left in gene sequences are too fuzzy to conclusively answer the latter, but we can certainly speculate. The bacteria we identified as harboring these ancient sulfa drug resistance genes are all soil and freshwater bacteria that thrive under the well-irrigated subsoil of farms. And farmers have been adding huge amounts of sulfa drugs to animal feed for the past 50 years.

The sublethal concentrations of sulfa drugs in the soil are the perfect setting for resistance genes to be transferred from these ancient resistant bacterial populations to other bacteria. All it takes is for one lucky bacterium to meet one of these ancient resistant ones in the subsoil. They trade some genes, one bacterium to the next, and resistance spreads until a newly minted resistant bacterium eventually makes it to the groundwater supply you drink from. You do the math.

Nothing new under the sun

As for why sulfa drug resistance genes would be around 500 million years ago, there are two plausible explanations. On the one hand, it could be that 500 million years ago there was a bacterium that synthesized sulfa drugs, which would explain the evolution of resistance. However, the lack of remnants from such a biosynthetic pathway makes this unlikely.

On the other hand, resistant bacteria may have been around just by chance. The argument here is that there are so many bacteria, and such diversity, that chances are that some of them are going to be resistant to anything scientists come up with. This is a sobering thought.

Then again, this is already the baseline for antibiotics. Like climate change, antibiotic resistance is one of those problems that always seem to be a couple decades away. And it may well be. A turning point for me in the climate change debate was a decade-old opinion piece in New Scientist. It stated that we should make every possible effort to prevent climate change, especially in the unlikely case that it was not caused by man, because that would mean that all we can do is palliate a natural phenomenon.

Our research points in the same direction. If resistance is already out there, drug development can offer only temporary relief. The challenge then is not to quell resistance, but to avoid its spread. It is a big challenge, but not an insurmountable one. Not feeding wonder drugs to pigs would do nicely, for starters.

* * * * *

Ivan Erill, Associate Professor of Biological Sciences, University of Maryland, Baltimore County

This article is republished from The Conversation under a Creative Commons license. Read the original article.

Header image by Drew Hays on Unsplash

Today in Genes, Genomes, Genetics, UMBC postdoctoral fellow Sarah Stellwagen and co-author Rebecca Renberg at the Army Research Lab published the first-ever complete sequences of two genes that allow spiders to produce glue—a sticky, modified version of spider silk that keeps a spider’s prey stuck in its web.

The innovative method they employed could pave the way for others to sequence more silk and glue genes, which are challenging to sequence because of their length and repetitive structure. Better understanding of these genes could move scientists closer to the next big advance in biomaterials.

Sticky solutions

Spider silk is what spider webs are made of, and it’s been touted for years as the next big thing in biomaterials because of its unusual tensile strength combined with its flexibility. There are more than 45,000 known species of spiders, each of which makes between one and seven types of silk. However, despite many partial sequences, less is known about the full genetic structure of spider silk: Only about 20 complete genes have been sequenced. “Twenty pales in comparison to what’s out there,” Stellwagen says.

Plus, spider silk has proven tough to produce in large amounts. Spiders convert liquid blobs of silk into solid, spindly fibers in a complex process inside their bodies. Scientists can make the liquid, but “we can’t replicate the process of going from liquid to solid on a large industrial scale,” Stellwagen says.

Spider glue, however, is a liquid both inside and outside the spider. While the glue “does have its own challenges,” Stellwagen says, that difference might make spider glue easier to produce in a lab than silk.

Stellwagen sees great potential for spider glue applications as organic pest control. After all, she says, “This stuff evolved to capture insect prey.”

For example, farmers could spray the glue along a barn wall to protect their livestock from insects that bite or cause disease, and then could rinse it off without worrying about polluting waterways with dangerous pesticides. They could use glue similarly to protect crops from pests. It could also be applied in areas where mosquito-borne illnesses are prevalent. “It could also just be fun to play with,” Stellwagen says.

A “behemoth of a gene”

Before Stellwagen and Renberg’s work, which was funded by the Army Research Lab, the longest silk gene sequenced was about 20,000 base pairs. When she started this project, Stellwagen was expecting to sequence the glue genes quickly and then move on, building on what she learned from the sequence. Instead, it took her and Renberg two years just to finalize the sequence.

“It ended up being this behemoth of a gene that’s more than twice as large as the previous largest silk gene,” Stellwagen says. It was a long, hard road to the day she found Renberg in the lab and said, “I think our gene is 42,000 bases long. I think we finished it.” And in the end, it was taking a risk on a cutting-edge technique that finally yielded the complete sequence.

Not only was the gene exceptionally long, but, like spider silk genes, it has many repetitions of the same sequence of bases—A, T, G, and C—in the middle. Modern sequencing techniques (called “next generation sequencing”) work by generating DNA sequences for all of an organism’s genes, but chopped up in little pieces. Then, like solving a puzzle, scientists must match up the overlapping ends of the short sections to determine the entire sequence.

However, if your gene is repetitive, you need a single sequence, or “read,” that extends from before the repetitious region to beyond the end to know how many repetitions there are. If your repetitious section is long, as it is in the glue genes Stellwagen and Renberg studied, the chance that you would get the read you need with next-generation methods is slim.

Fortunately, “third-generation” sequencing techniques are now available. Third-generation sequencing produces longer reads, but fewer of them. Only by repeating the experiment several times do you have a chance of getting the reads you need to determine the number of repetitions and finally define the gene’s entire sequence. “It’s challenging,” says Stellwagen. “You’re picking a needle from a haystack.”

But it worked. After two years of going to the computer and not seeing positive results, Stellwagen and Renberg finally got the reads they needed to define the entire gene’s sequence.

Stellwagen is already thinking ahead to what comes next. “Now that we have a protocol for discovering full-length silk genes, what do silks from other species look like?” she asks.

“I’m super excited that I was able to finally figure out the puzzle, because it was just so hard,” Stellwagen says. While it was a much bigger challenge than she expected, “Ultimately we learned a lot, and I am happy to put that out there for the next person who is trying to solve some ridiculous gene.”

Banner image: Sarah Stellwagen (left) and her postdoctoral advisor Mercedes Burns work together in the lab. All photos by Marlayna Demond ’11 for UMBC.

Read the complete article in G3: Genes, Genomes, Genetics.

Learn how to use R, a free software program for statistical computing and graphics!

The Center for Social Science Scholarship is partnering with SAGE Campus to offer a free 30 day Introduction to R for Social Scientists online course.

The course will open on June 17.  It takes around 12 hours to complete, and learners will be given 30-day access to complete the course at their own pace.  Course objectives and more information are available here.

Enrollment is limited to 5 learners, on a first-come, first-served basis. Email socialscience@umbc.eduto indicate your interest, and please provide your full name, preferred email address, affiliation, and home department. 

Since enrollment is limited, please sign up only if you are certain you can complete the course!  We will confirm if you have been selected. If capacity is full, we will add your name to a waiting list as we gauge interest in offering this or similar courses again in the future.