Summary: Kevan Shokat has developed a chemical-genetics technique to decipher individual kinases and their cellular signaling networks. His goals are to understand each kinase’s role in the body and to learn which kinases would be good drug targets.

September 15, 2008, Howard Hughes Medical Institute – Research in my laboratory is focused on the discovery of new chemical-based tools to decipher cellular signaling networks, with an emphasis on protein kinases. The analysis of signal transduction pathways is challenging using the traditional tools of biochemistry, genetics, and chemistry. Biochemical approaches are often limited because signaling networks span from the cell surface to the control of transcription and translation, confounding reconstitution efforts from purified proteins. Genetic approaches allow perturbation of single components in an intact cell or organism, yet they are often confounded by the rapid evolvability of the networks. Chemical and pharmacological approaches enable rapid, reversible, and graded (dose-dependent) inactivation of single components in intact cells or organisms. Unfortunately, highly selective chemical probes (e.g., agonists, antagonists, traceable substrates) of protein kinases are difficult to develop because the 500 protein kinases share highly homologous ATP-binding pockets.

To solve this fundamental problem in the case of protein kinases, we have developed a strategy that combines protein engineering and organic synthesis. This approach, which we have termed chemical genetics, relies on genetics to specify the target of a small molecule, ensuring that only the intended protein is targeted by the small molecule we synthesize. Through mutation of a large conserved residue, the “gatekeeper residue,” in the ATP-binding pocket of kinases to a nonnatural small amino acid (glycine), we can sensitize any kinase to inhibition by 1-NAPP1, which only inhibits kinases containing a glycine at the gatekeeper position. (See the short animation, based on the crystal structure of the tyrosine kinase c-Src, which highlights the structural basis for selectivity of 1-NAPP1 and the mutation of the gatekeeper position that allows inhibition by 1-NAPP1.)

We have also developed chemical-genetic tools for identification of novel direct kinase substrates of any protein kinase in the genome. In addition to inhibiting and/or tracing the function of any kinase in the genome, we have developed the first ATP-competitive agonist of a protein kinase, a chemical cross-linker capable of trapping phosphoproteins to the kinases responsible for their phosphorylation, a chemical-enzymatic approach for mapping the phosphoproteome, a perfectly specific inhibitor of any myosin motor protein, and developed isoform-selective inhibitors of phosphoinositol-lipid kinases.

Protein Kinase Inhibitors: Toward a Pharmacological Map of Cell Signaling
A central experimental paradigm used for probing components of signal transduction pathways is perturbation through induced loss of function. The chemical-genetic approach for generation of monospecific inhibitors of any protein kinase is a powerful method for mapping cell signaling. In studies using these highly specific inhibitors (e.g., 1-NAPP1), we have found that signaling cascades are differentially dependent on the catalytic activity of kinases in a pathway. Specifically, partial inhibition of some kinases results in complete blockade of the entire cascade (e.g., cell cycle progression is highly sensitive to the catalytic activity of cyclin-dependent kinase 1), whereas equipotent inhibitors of other kinases in the same cascade are only capable of blocking a fraction of the output of a cascade (e.g., T cell signaling is minimally sensitive to blockade of Lck activity). Our working hypothesis is that the differential sensitivity of signaling cascades to inhibitors of different kinases is related to the quantitative relationship between signal output and catalytic activity of each kinase in a cascade. Toward our goal of developing a specific small-molecule inhibitor of every protein kinase in the human, mouse, yeast, worm, and fly genomes, we have applied the chemical-genetic approach to more than 75 protein kinases.

Phosphoproteomics: Affinity Tags for Protein Kinase Substrates
The search for the complete set of all protein kinase substrates has become a major goal of many laboratories. It is estimated that one-third of the proteome is phosphorylated, making the tracing of the substrates of more than 500 kinases challenging. To address this problem we have devised a chemical method for radioisotope tagging the direct substrates of any protein kinase, using a [γ- 32P]-labeled ATP analog, N6-(benzyl)ATP. This ATP analog is a poor substrate of wild-type protein kinases but is efficiently accepted by any kinase of interest by virtue of a mutation that enlarges the ATP-binding site to accommodate the N6-benzyl substituent. Identification of the 32P-labeled proteins via traditional two-dimensional gel purification and mass spectrometry has identified hundreds of novel substrates of more than 50 widely divergent kinases, such as v-Src, CDK2, JNK, Cdc28, Erk2, Srb10, and Kin28. The remaining hurdle to the completion of the phosphoproteome map of all kinases is identification of the very low abundance (~100 molecules/cell) substrates. In the past year we have developed a new method for solving this problem.

The key to kinase-catalyzed delivery of an affinity handle is to assemble the tag in two steps. First, a uniquely reactive phosphate mimic, phosphorothiolate (PO3S–), is delivered to kinase substrates via N6-(benzyl)ATP-γ-S and a mutant kinase. Next, a synthetic thiol-reactive electrophile is used to functionalize the phosphorothiolate and provide an affinity handle for antibody recognition. We have developed a monoclonal antibody that is capable of uniquely recognizing the chemically derivatized phosphate analog on the surface of phosphoproteins. Although the electrophile reacts with other thiols, such as cysteines, only the adduct with the phosphorothiolate is specifically recognized by this monoclonal antibody. The ability to directly affinity purify substrates of any kinase in the genome will allow for the mapping of any kinase pathway in a cell and development of a complete picture of the complex networks of kinase signal transduction pathways. Our long-term goal is to use these chemical tools to identify all the direct substrates of each kinase in the human genome. We are also developing approaches for introducing these ATP analogs directly into intact cells, allowing for the direct labeling of substrates in their undisturbed cellular compartments.

…………………………………………………………………

Kevan M. Shokat, Ph.D.

2E217ED0-0DFF-4B86-B93A-905C1EFDC845.jpgInside the 10 trillion cells of the human body, a vast communications network hums under the control of some 70,000 proteins, orchestrating everything from memory to immunity. Amid this cacophony, scientists have struggled to tune in the distinctive chemical tones of the kinases: a large family of signaling molecules that are critical for almost all cellular activity.

Kevan Shokat has marshaled the resources of chemistry, protein engineering, and genetics to solve this significant biological challenge and provide scientists with the tools they need to understand the function of individual kinases within a cell. All kinases work by transferring energy, in the form of a phosphate, from adenosine triphosphate (ATP)—a molecule that stores energy for the cell, much like a battery—to other proteins. But since roughly 600 kinases exist, the challenge lies in focusing on a specific one.

Shokat has devised an approach to solve that problem, using chemical genetics to decipher individual kinases and their cellular signaling networks. His goals are to understand each kinase’s role in the body and to learn which kinases would be good candidates for drug development. His lab currently is working to identify kinases that may play a role in asthma, diabetes, some forms of cancer, neurological disorders, bacterial infections, drug addiction, and chronic pain.

Using his chemical-genetics approach, Shokat mutates a particular kinase of interest and then designs a labeled molecule, or substrate, that only binds to the mutated kinase. Thus, specific kinases can be tagged and tracked along their signal transduction pathways inside cells. Shokat’s lab also has developed a “knockout” technique to shut down, or inhibit, one specific kinase at a time, allowing researchers to study the effect on cell signaling. Over the past seven years, scientists have used these chemical-genetics techniques to study more than 70 protein kinases involved in a wide range of jobs inside the cell.

In a separate project, Shokat has developed a method to map the locations on proteins where phosphates bind inside cells. By pinpointing bond locations, scientists could correlate bond patterns with disease. Drugs might be designed to block a particular kinase before it carries phosphate to a specific bond site.

Ultimately, Shokat’s chemical-genetics strategy could lead to a map of the “phosphoproteome,” the complete set of all protein kinase substrates in the body. The tools also promise to reveal the workings of other important protein families, such as myosin motor proteins, lipid kinases, and deyhdrogenases, which Shokat’s lab also has begun to study.

Dr. Shokat is also Professor of Cellular and Molecular Pharmacology at the University of California, San Francisco, and Professor of Chemistry at the University of California, Berkeley.

RESEARCH ABSTRACT SUMMARY:

Kevan Shokat has developed a chemical-genetics technique to decipher individual kinases and their cellular signaling networks. His goals are to understand each kinase’s role in the body and to learn which kinases would be good drug targets.

September 14, 2008, Howard Hughes Medical Institute – Researchers have devised clever new techniques to mimic the chemical marks on tightly wound DNA-protein complexes that silence gene expression. The scientists have used these complexes to visualize gene silencing in its natural context for the first time.

Howard Hughes Medical Institute investigators Karolin Luger, Kevan Shokat, and their colleagues published their findings on September 14, 2008, in an advance online publication in the journal Nature Structural & Molecular Biology. Luger is at Colorado State University and Shokat is at the University of California, San Francisco.

“These structures revealed conclusively that the structure of the nucleosome itself is not significantly altered by the two types of methylation.”
Karolin Luger

During growth and development, genes that should not be expressed are physically tagged with chemical groups such as methyl groups. Genes can also be silenced by modification of the histone proteins that make up the “smart stuffing” in chromosomes.

Histones make up the spool of proteins around which DNA winds so that it is packaged compactly in the nucleus. The protein-DNA nucleosome complexes, in turn, are packed into repeating units called chromatin, which is the building block of chromosomes. When methyl groups are added to a histone, they modify its properties and alter the frequency at which a particular gene is expressed. Histone proteins both protect DNA and regulate genes as they combine with DNA to form chromatin.

Despite its importance, histone methylation has remained enigmatic. “Although methylation has been appreciated as an important epigenetic marker, very little was known mechanistically about what methylation does to chromatin,” said Luger. “Experimentally, it has been an intractable area.”

The new experiments involved creating artificial nucleosomes bearing chemically synthesized methylation marks that mimic natural gene-silencing tags. With this new set of tools, Luger and her colleagues did x-ray crystallographic and biophysical studies to see how methylation affects the structure of chromatin and nucleosomes.

The researchers began their work with the goal of learning how two different methylation marks affect the overall structure of nucleosomes and chromatin. They chose to study one mark that activates genes and one that represses genes. The activating mark consisted of two methyl groups attached to the amino acid lysine (also called a lysine residue) in a specific portion of the histone H3. The repressive mark was composed of three methyl groups attached to a lysine on the H4 histone. Histones H3 and H4 are two of the five main histones that regulate the structure of chromatin. Knowing the specific location of the lysines is important because histones contain many lysine residues and activation or repression of genes only occurs when the methylation marks are attached to the correct lysine.

Past structural studies of methylation were hindered by the extreme difficulty of constructing homogeneous samples of histones bearing methyl groups attached to specific lysine residues. However, Shokat and his colleagues had synthesized a chemical structure in the lab that mimics lysine with the methyl groups attached. With this methyl-group mimic in hand, his team could then synthesize purified histones with methyl groups inserted at any desired point on the histone structure. Matthew Simon, a postdoctoral fellow in Shokat’s laboratory, produced pure samples of H3 and H4 histones with the desired methylation marks.

Luger and her colleagues next packaged the modified histones they received from Shokat’s group into recombinant nucleosomes and chromatin. After they had successfully created their nucleosomes, Xu Lu, a postdoctoral fellow in Luger’s lab set about crystallizing the nucleosomes so that they could analyze their structure using x-ray crystallography. In this widely used technique, x-rays are directed through crystals of a protein, and its structure deduced from the pattern of diffraction of the beam. “These structures revealed conclusively that the structure of the nucleosome itself is not significantly altered by the two types of methylation,” said Luger.

“The ability of our laboratory to make homogeneous histones with the appropriate methylation was essential for the crystallography,” said Shokat. “If there had been any significant contamination, it would have been almost impossible to solve the structure. And the nice thing about the synthesis technique we developed is that it is incredibly scalable. We can make kilograms of the material if we need it, which is a real advantage for crystallography.”

In a second set of analyses, co-author Jeffrey Hansen and Xu Lu measured how methylation affected the condensation of recombinant chromatin formed from the methylated histones. Hansen, who is at Colorado State, used analytical ultracentrifugation to assess compaction. This analysis revealed that activating methyl marks on the H3 histone caused little alteration in the structure of chromatin when compared to nonmethylated counterparts. However, the repressive methyl groups on the H4 histone caused the arrays of nucleosomes to become significantly more compacted. “They were much more able to form chromosomal fibers,” said Luger.

The researchers’ experimental approach offers new tools and methods to explore the structural effects of methylation, said Luger. “We believe that the nucleosomes will always retain their basic shape,” she said. “But the interesting question will be whether their dynamics change with methylation—whether individual nucleosomes may have a higher propensity to unfold, to unravel slightly or just to be remodeled.”

Luger and her colleagues are also setting their sights on studying how combinations of histone modifications—a more common gene control mechanism—affect the structure of nucleosomes and higher order chromatin. “In this initial study, we used a very simplified system in which every nucleosome carried the same modifications” said Luger. “But clearly, one can imagine biological systems using complex combinatorics of markers for epigenetic control.”

………………………………………………………………………………

Karolin Luger, Ph.D.

4A4BD566-96AF-4F00-A208-1AA52ADF2D56.jpgDNA carries the fundamental genetic information essential to life—but it is hardly a solo performer in the cell’s nucleus. In fact, its billions of base pairs are tightly packed together with proteins into a complex called chromatin, whose structure controls whether the cell can transcribe genes and replicate and repair DNA.

Scientists like Karolin Luger are constantly angling for better images of this central structure, and early in her career, she snapped one of the best. In 1997, Luger and her colleagues used x-ray crystallography to reveal the structure of a core chromatin particle with unprecedented detail. This work not only demonstrated how structural aspects of chromatin guide its role in DNA transcription, replication, and repair, but has also provided the foundation for further studies by others in the chromatin field.

Luger has used her structure of the nucleosome—a fundamental chromatin component made up of a disk of proteins surrounded by DNA—as merely a starting point. Since that achievement, she has shifted her focus from what the nucleosome is to what it does.

At the most fundamental level, the nucleosome is believed to regulate access to DNA during gene transcription. Luger’s more ambitious goal is to understand how the structure varies, based on changes in its own proteins or interactions with outside molecules. Ultimately, she hopes to refine the overall view of how chromatin is organized at higher levels.

To address these issues, Luger complements her structural studies with biochemical and biophysical experiments, and the results have shed light on how the nucleosome changes shape and how chromatin interacts with the cell’s transcription machinery. Variations in histones—the major protein component of the nucleosome—play a significant role in regulating gene expression, and Luger is carefully characterizing how subtle changes in these proteins can affect overall nucleosome structure.

Luger’s recent work has concentrated on how histone “chaperones” promote structural changes in nucleosomes and facilitate the sliding of histones along the DNA. These proteins, which were previously thought of as chaperones in the true sense of the word—in that they guide histones to the DNA and prevent them from making “improper” interactions—now appear to also have a very active role in promoting nucleosome dynamics; the chaperones have joined the dance.

Dr. Luger is also Professor of Biochemistry and Molecular Biology at Colorado State University.

RESEARCH ABSTRACT SUMMARY:

Karolin Luger is investigating the structural biology of chromatin. Luger hopes to refine the overall view of chromatin’s architecture by understanding how the nucleosome interfaces with the cellular machinery through sequence variations in its own proteins or interactions with outside molecules.

BGP is the core routing protocol of the Internet and yet it appears that BGP’s trusting nature allows attackers to intercept Internet traffic. The problem has been known for a long time so why hasn’t it been fixed? I’d like to answer that and point out a new twist.

By Michael Kassner, September 14, 2008, TechRepublic.com – At this year’s DefCon, security researchers Anton Kapela (data center and network director at 5Nines Data) and Alex Pilosov (CEO of Pilotsoft) explained Border Gateway Protocol (BGP) eavesdropping, which is the new and improved method of BGP redirection. BGP eavesdropping is shaping up to be as much a concern as Dan Kaminsky’s bug that I wrote about: “DNS: The Internet dodged a bullet, thankfully.”

BGP is a “behind the scene” protocol in the realm of ISP routers. We all know the Internet is one huge interconnected network and BGP routing is the method whereby interconnected routers know how and where to send Internet traffic. Routers that are a single hop from each other are called BGP neighbors. BGP neighbors exchange routing information as soon as there’s an active network connection between the routers. If any changes occur to its BGP routing table, the router automatically sends the changes to all of its neighbors. The BGP neighbor concept is a big part of why the Internet is a very resilient mesh network.

Since the Internet is a mesh network, there will always be multiple entries for each route. So how does the router know which neighbor to pick? First, each BGP entry has several attributes that measure different properties of the route. Then an algorithm selects the best route from these attributes. Some attributes are weight, local preference, origin, and AS_path (remember this one). Not quite done yet, BGP checks one more parameter and it’s an important one . Especially since this parameter is the fundamental design flaw that allows BGP eavesdropping.

In order to find the best route, BGP considers the granularity of each advertised network. For example, say that a router is looking for IP address 10.10.10.25. Looking into its BGP routing table, the router finds a route entry advertising the 1o.xxx.xxx.xxx network. The router also finds another entry advertising the 1o.10.xxx.xxx network. Since the 10.10.xxx.xxx network is a better match, the router will choose that entry, sending the packets to the router advertising the 10.10.xxx.xxx network. Each router along the path repeats this process until the Internet traffic reaches its destination.

Needless to say, BGP can be complicated. It might be best to step through the process by using an example; let’s say I want to go to www.techrepublic.com:

1. I type www.techrepublic.com into the Web browser’s address bar and click OK.
2. Through the magic of DNS, my Web browser now knows the IP address of www.techrepublic.com and sends a Web page query to my ISP’s gateway router.
3. The gateway router then checks its BGP routing table for the best route.
4. Through the BGP selection process, the gateway router selects the best route and forwards the query onto that router. This discovery process occurs at each router along the path until the query reaches www.techrepublic.com.

Now that we have a good idea of how BGP works, I’d like to check out the design flaw that allows BGP redirection and eavesdropping. Basically, BGP trusts routing information from BGP neighbors entirely too much. The router just assumes that the BGP routing entry is correct and sends the packets on their way.

An attacker makes use of this unbridled trust in order to affect a BGP redirection attack. All the eavesdropper needs to do is advertise network addresses that are more granular (closer to the real IP address, use 10.10.25.xxx for example) than the ones offered by official BGP neighbors. After the false BGP entries have propagated, it wouldn’t take very long before redirected traffic begins flowing to the attacker’s network.

Redirecting BGP traffic isn’t new, in fact many of you may remember the YouTube outage that occurred this past February. That outage was the result of an accidental BGP redirection by an ISP in Pakistan. If you need a refresher (I did), InfoWorld’s article, “YouTube outage underscores big Internet problem,” is where to go. In addition, exact details and interactive display are available at the RIPE (Reseaux IP Europeens) NCC Web site.

Autonomous System routers

If you went to the RIPE Web site, you may have noticed router designators like AS17557. Autonomous System Numbers (ASN) are assigned to each Autonomous System (AS) to uniquely identify it. To avoid getting in over my head, let’s just say that an AS is a collection of IP routing information controlled by a single entity. With that entity being responsible for propagating BGP routes to all of the routers it services.

Two redirections

It’s very obvious when BGP redirection is taking place and that’s not what the malevolent types want. To explain using the YouTube example, once the BGP routing changes made by the Pakistani ISP propagated, YouTube’s Web site became inaccessible, and raised all sorts of flags.

Kapela and Pilosov have found a way to make Internet users none the wiser to a redirection attack. They innovatively added a second redirection, which changes the process to a Man-in-the-Middle (MitM) attack vector called BGP eavesdropping. Experts knew this was theoretically possible, but apparently, it’s never been demonstrated until DefCon 2008.

Kapela and Pilosov really impressed me by how they were able to add the second redirection, as it’s not an intuitive process. To prove that, I’d like to recap exactly what’s happening. First, the attack router is deceitfully advertising itself as the best route to the original destination network. Because of how BGP works, we know that the wrong routing information has propagated to all of the attack router’s BGP neighbors. With all of attack router’s BGP neighbors now pointing at the attack router as the best route, any traffic the attack router tries to forward to the original destination network (through the BGP neighbors) would be sent back by the BGP neighbors. Now, that’s a problem, but here comes the cool part.

AS path prepending

Pilosov and Kapela bypass this problem by using AS path prepending. Path prepending uses the AS_path attribute I mentioned earlier. In a round about way, adjusting the AS_path attribute value forces selected AS routers to reject the attack router’s deceptive BGP entry. The attacker then forwards the Internet traffic to that specific BGP neighbor. From that point on, the Internet traffic uses the normal BGP routing process until it reaches the original destination.

What does this mean?

There’s precious little evidence that BGP eavesdropping is going on. Route tracing is one way of determining if something is not quite right, but it’s difficult to pinpoint the anomaly. To be safe, we need to consider this a MitM attack and use the same mitigating techniques, which for now would amount to VPNs.

Several interim solutions are being proposed to rectify the design flaw. Allowing only authorized BGP neighbors is one solution, but it’s labor intensive and if one ISP declines to use it the whole system breaks. Another solution would use signed certificates, which would authenticate BGP neighbors to each other, but this is only affective for the first hop.

One solution that will solve the design flaw is Secure BGP (S-BGP). The following quote is from their Web site and explains how S-BGP works:

“The S-BGP architecture employs three security mechanisms:
First, a Public Key Infrastructure (PKI) is used to support the authentication of ownership of IP address blocks, ownership of Autonomous System (AS) numbers, an AS’s identity, and a BGP router’s identity and its authorization to represent an AS.

Second, a new, optional, BGP transitive path attribute is employed to carry digital signatures covering the routing information in a BGP UPDATE. These signatures along with certificates from the S-BGP PKI enable the receiver of a BGP routing UPDATE to verify the address prefixes and path information that it contains.

Third, IPsec is used to provide data and partial sequence integrity, and to enable BGP routers to authenticate each other for exchanges of BGP control traffic.”

S-BGP sounds great, but most existing routers don’t have enough memory or processing power to handle the additional workload. For more detail on S-BGP and alternative solutions, Wired has a good article, “Revealed: The Internet’s Biggest Security Hole.”

Final thoughts

It becomes very apparent that the original Internet developers lived in a time when workability and trust, not security were the order of the day. Both Kaminsky’s bug and BGP eavesdropping are perfect examples of that. I’m not sure what that all means, but I will remain optimistic.

That aside, BGP eavesdropping is going to be hard to fix, simply because of cost and overhead. I’m pretty certain that ISPs aren’t going to jump on the bandwagon, unless pushed by us users.

Michael Kassner has been involved with wireless communications for 40 plus years, starting with amateur radio (K0PBX) and now as a network field engineer for Orange Business Services and an independent wireless consultant with MKassner Net. Current certifications include Cisco ESTQ Field Engineer, CWNA, and CWSP.