While much of aviation cybersecurity focuses on network-based threats, researchers just showed that a physical attack on an airplane may require surprisingly little time or money.
Researchers at the University of California San Diego and Oberlin College built a small, coin-sized device that can take over communications between two key flight computers on Boeing 737 aircraft.
The prototype costs less than $100 to build and can be plugged into a maintenance port inside an electronics bay underneath the plane’s nose. The bay can be accessed from the ground through an exterior hatch that is not locked and is routinely accessible to maintenance workers and other airport staff.
The researchers estimate that an attacker would only need 60 seconds to intall the device.
The protoype they built is Wi-Fi enabled, which the researchers say could theoretically allow it to connect to the plane’s in-flight Wi-Fi and be controlled remotely over the internet.
“Our goal with this research is to alert the aviation community to this class of risks, so they may be appropriately mitigated well before they become dangerous,” the researchers wrote in a paper presented this week at the USENIX Security Symposium in Baltimore.
How the hack works
Once intalled, the device can interfere with communications between the aircraft’s Flight Management Computer, which manages its flight plan and provides important information used during takeoff, and the Multipurpose Control Display Unit pilots use to control it.
That gives the device the ability to secretly change a plane’s flight plan while preventing those changes from appearing on the pilot’s display. The researchers described scenarios in which hackers could cause the autopilot to divert the aircraft into another country’s airspace or just send it off course.
The researchers also demonstrated that the device could manipulate information about the plane’s weight, balance and outside temperature, making a takeoff unsafe.
“We believe we have made a strong case that time-limited physical access (e.g., 60 seconds) represents a realistic goal for a motivated attacker and that the consequences of even such short access can be significant (and hence are worthy of attention),” the researchers wrote.
The Boeing 737 is one of the most widely used commercial aircraft in the world, with about 8,000 currently in service, according to UC San Diego. The aircraft makes up roughly 25% of Delta’s fleet, 38% of American’s, 53% of United’s, and all of Southwest Airlines’ fleet. Still, the researchers say their findings point to a broader cybersecurity risk across the aviation industry.
What can be done about it?
The researchers first alerted Boeing to their findings in 2020 and continued working with the company over the next several years.
Still, the researchers say they don’t know whether Boeing has done anything to fix the vulnerability.
Their proposed fixes include tighter security around who can access planes on the ground, or simply blocking the vulnerable port with epoxy or removing it altogether.
Boeing did not immediately respond to a request for comment. But the company told Wired that it had reviewed the researchers’ findings and believes existing safeguards are enough to reduce any risks.
“Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks,” Boeing told Wired.
The researchers admit an attack of this type he would require significant planning and engineering expertise. They also acknowledge that an attentive pilot could recover from most of the attacks they tested.
“All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so,” the researchers wrote.
