Security researchers from the University of California San Diego and Oberlin College have developed a coin-sized, Wi-Fi-enabled device capable of physically compromising a Boeing 737's systems in under a minute. The device, which costs less than $100, can be plugged into an externally accessible port on the aircraft, allowing an attacker to redirect its autopilot or subtly alter critical flight calculations.
The researchers plan to present their findings at the Usenix cybersecurity conference. Their work demonstrates that with physical access, an attacker could spoof commands to sensitive computer systems, potentially leading to scenarios ranging from runway overruns during takeoff to diversions into unauthorized airspace, or even catastrophic crashes. The device can also manipulate data displayed to pilots, such as total aircraft weight or outside air temperature, which are crucial for takeoff calculations.
The team, led by UCSD computer science professors Stefan Savage and Aaron Schulman, along with research scientist Kirill Levchenko, spent over a decade on this project. Their initial motivation stemmed from the question of what could be achieved with 60 seconds of physical access to an aircraft. They discovered a port that is routinely within reach of maintenance or airport staff and requires no special tools to access, allowing for the rapid insertion of their hacking device.
The researchers have not disclosed the specific port targeted or the precise methods used to spoof commands, citing security concerns. However, they have been in communication with Boeing about their findings for over six years, even demonstrating their attack in a Boeing test lab.
Boeing has acknowledged the research, stating that its technical experts have reviewed component designs, installations, and interfaces. The company maintains that existing layers of protection, both in system design and the operating environment, sufficiently mitigate the feasibility and risk of real-world attacks. Boeing has not indicated any immediate plans for a technical fix.
Despite Boeing's assessment, the researchers argue that their work highlights a significant blind spot in aircraft security and the need for long-term changes. They suggest simple fixes like plugging the vulnerable port with epoxy or removing it entirely. They emphasize that while their findings are serious, they do not warrant panic or the grounding of aircraft, and all authors of the paper continue to fly on Boeing 737s.
The research team's interest in aviation security began nearly 15 years ago after successfully demonstrating over-the-internet hacking techniques for car computer systems. Inspired by this work, they embarked on the challenging task of acquiring and assembling Boeing 737 computer components from the secondhand market, spending tens of thousands of dollars to create an "avionics test bed" they named Triton by 2019.
The concept of a physical access attack on an internal network, or "bus," emerged from Schulman's prior work on credit card skimmers. This led the team to consider the possibility of a similar method being effective against aircraft systems, prompting a reevaluation of existing security assumptions.
