Researchers at the University of California San Diego have demonstrated that a Boeing 737 airliner can be hacked in less than a minute using a custom hardware device no larger than a 10p coin.
The attack targets communications between two critical onboard computers: the flight management computer, which processes navigation data, and the cockpit display computer, which presents flight path information to pilots.
To execute the compromise, an attacker only needs to plug the device into a port inside the belly of the plane. Investigators found that the breach takes less than 60 seconds on a Boeing 737 whether the aircraft is parked at an airport gate or inside a hangar.
"We believe we have made a strong case that time-limited physical access (e.g., 60 seconds) represents a realistic goal for a motivated attacker," the researchers said in their report. "The consequences of even such short access can be significant (and hence worthy of attention)."
Accessing the electronics bay
In commercial aviation cybersecurity, physical access to an aircraft is typically not treated as a primary risk factor, as security protocols rely heavily on airport ramp controls and airfield perimeter security.
However, the research team set out to investigate whether an attacker who gains physical access to an airliner could successfully exploit its internal electronic systems. "Our goal with this research is to alert the aviation community to this class of risks, so they may be appropriately mitigated well before they become dangerous," said Aaron Schulman, one of the senior authors of the work.
While conducting their study on a Boeing 737, the team discovered an unused maintenance port inside the plane's Electronics and Equipment (E&E) bay, a compartment housing critical electronic equipment.
Located underneath the nose section of the fuselage, the E&E bay can be reached directly from the ground without special equipment, and its access hatch is not locked. "What we found in our work, is that there's a plug that is deep in the E&E bay, that if you open the door, and get inside, you can then touch from the ground," Mr Schulman explained. "And if you attach something to that plug, it actually gives you full control over the entire flight management computer."
Overpowering avionics communications
The maintenance port contains two digital communications channels, known as buses, which transmit information and instructions between the flight management computer and the cockpit display unit. These buses run on ARINC 429, a technical standard developed decades ago for avionics architecture.
Because ARINC 429 systems lack modern security features such as cryptographic authentication, designing and building a small hardware implant to override them proved relatively simple for the researchers.
The custom device functions by broadcasting a strong signal that overpowers genuine data transmissions across the bus wiring. This mechanism allows the device to secretly send modified instructions to the onboard computers while concealing the changes from system checks.
During a live demonstration, the team showed that the implant could alter a plane's route while in flight, or manipulate critical data governing aircraft weight, balance, and temperature parameters, which could lead to an unsafe takeoff.
Because the pilot receives no automated warnings when the signals are intercepted, the tampering remains completely undetected in the cockpit. "The pilot doesn't have any knowledge that something is going on," Mr Schulman said. "So it's a very covert and inconspicuous type of control that you can have with this kind of attack."
Reassurance for air travelers
The researchers specifically selected the Boeing 737 for their study because it is one of the most widely used commercial passenger aircraft in global aviation. Manufactured by Boeing, the narrow-body twin-jet is deployed extensively by airlines worldwide for short and medium haul flights.
Despite the severity of the security flaw, the researchers reassured the public that their hacking device is strictly controlled and will remain locked away to prevent any unauthorized misuse.
The study authors added that they maintain full confidence in flying on the aircraft themselves. "All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so," Mr Schulman said.
