Boeing 737 can be hacked with a coin-sized $100 device

Researchers from the University of California San Diego and Oberlin College have built a coin-sized, Wi-Fi-enabled hacking device, costing less than $100, that can commandeer the autopilot of a Boeing 737 or silently alter the plane's takeoff and fuel calculations while spoofing the correct values on the pilot's screen. They present the technique, which they call Bus Driver, at the Usenix cybersecurity conference. The device fits into a port accessible through a hatch on the plane's exterior, one routinely within reach of maintenance workers or other airport and airline staff between flights. Fitting the implant takes less than a minute; Stefan Savage, one of the UCSD computer science professors who led the project, says the port itself can be reached with no special tools in about 15 seconds: "You can shove in a piece of electronics a little bigger than a quarter that lets you basically tell the autopilot what to do and lie to the pilot about changes to the flight plan."

The port connects to an internal 737 bus carrying data for two critical components: the Flight Management Computer and the Multipurpose Control Display Unit. A then student researcher, Sam Crow, found the port by going through hundreds of pages of Boeing wiring diagrams, then discovered that sending electrical signals at a higher current than the legitimate ones lets an attacker override commands on that bus. Once connected, the device can alter waypoints in the autopilot to redirect the plane's flight, or change variables like weight and outside air temperature that feed into takeoff calculations, while blocking those changes from appearing on the pilot's display. Aaron Schulman, a UCSD professor on the team, illustrated a subtle version: a course change of 3 degrees while flying over the Pacific, invisible against open water until the plane is far off route. The prototype also carries a Wi-Fi radio that, the article notes, would in theory let it connect to the internet through the plane's in-flight Wi-Fi and beacon out to a remote attacker, though the article does not describe this capability as tested in a real deployment.

The research grew out of the same team's earlier work hacking a Chevy Impala's OnStar system over the internet, work that reshaped automotive cybersecurity practice. Kirill Levchenko, then a UCSD research scientist, proposed turning to planes nearly a decade and a half ago; Savage recalls objecting that the team could not simply buy a plane. Instead, over the following years, they spent tens of thousands of dollars buying secondhand 737 components, assembling a wired together avionics test bed they called Triton by 2019. Crow continued refining the device, including during the Covid years working from his home, until it was small enough to hide inside the port under its usual dust cap.

The team first alerted Boeing to its findings in spring 2020, more than six years before this article's publication, and has since demonstrated the attack inside a Boeing test lab. Boeing told WIRED it carried out its own review of the affected components' design, installation and interfaces, and pushed back on the practical risk: "Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks." The researchers say Boeing has not told them of any technical fix, and they speculate a fix could take years given how rarely commercial aircraft are redesigned. They are withholding which exact port they targeted and some technical details of the spoofing method. Their paper proposes plugging the vulnerable port with epoxy or removing it as the simplest fix, and longer term suggests software that detects the Bus Driver technique, better electrical isolation between systems as used on some military aircraft, or cryptographic authentication of commands between components.

Key facts

The prototype device costs less than $100 and can be fitted into the 737's externally accessible port in under a minute; the port itself can be reached with no special tools in about 15 seconds.
It taps a bus linking the Flight Management Computer and Multipurpose Control Display Unit, letting an attacker redirect autopilot waypoints or alter takeoff and fuel variables while spoofing correct values on the pilot's display.
The work, called Bus Driver, took more than a decade and tens of thousands of dollars in secondhand 737 parts; the team first disclosed it to Boeing in spring 2020 and has demonstrated it inside a Boeing test lab.
Boeing reviewed the affected components and told WIRED its layered protections significantly limit real-world risk; the researchers say Boeing has not given them a fix timeline and expect none for years.
The researchers' proposed fixes range from plugging the port with epoxy or removing it now to cryptographic authentication of internal commands as a longer-term defense.

Why it matters

Cars, medical devices, water utilities and power grids have all fallen to remote or physical cyberattacks, but aircraft computer systems were long considered uniquely hard to reach. This research shows a well-funded, patient attacker can get comparable control over a 737's autopilot and cockpit displays through a single unlocked exterior port, without needing to smuggle explosives or breach any network defense. Compared with planting a bomb, the researchers argue the technique gives an attacker more control, more stealth and more deniability, which is why they frame it as a blind spot the aviation industry has not had to think about before.

Who it affects

Boeing 737 operators and the airlines that fly them are directly exposed, since the vulnerable port is reachable by anyone with routine ground access to the aircraft, including maintenance workers and airport or airline staff between flights. Passengers and crew are affected indirectly, as any successful attack would target the plane they are on. Beau Woods, a cybersecurity consultant who has advised the Cybersecurity and Infrastructure Security Agency and served on Boeing's Industry Cyber Technical Council, frames the exposure industry wide: someone on staff could approach a grounded aircraft during maintenance and gain this kind of access, a scenario not limited to Boeing.

How to use it

For the aviation industry, the researchers' immediate recommendation is physical: plug the vulnerable port with epoxy or remove the connector altogether, closing the easiest path to the exposed bus. Longer term, they suggest 737 systems be updated to detect the Bus Driver technique in software, to electrically isolate components more the way some military aircraft do, or to add cryptographic authentication so spoofed commands can no longer pass as legitimate ones. Savage frames the more immediate lever as operational: tightening who can access a parked aircraft and when, since the hardware fix depends on a redesign that may be years away.

How solid is it

The claim rests on a working prototype rather than a theoretical model. The team spent tens of thousands of dollars over more than a decade buying real secondhand 737 components to build an avionics test bed, called Triton, that let them verify the Bus Driver technique against actual hardware, and they have demonstrated the attack inside a Boeing test lab. They have been sharing findings with Boeing since spring 2020, giving the company more than six years to evaluate and respond before this disclosure, and they present the peer reviewed work at Usenix, a major academic security conference.

Risks and caveats

The researchers withhold which exact port they targeted and some technical detail of how the device spoofs commands, so outside verification of specifics is not possible from the article. They and Boeing agree a careful pilot could likely recover from most of the attacks they describe: manual control overrides the autopilot, and correct values would still appear on a separate cockpit screen even if the Multipurpose Control Display Unit is compromised, though Schulman notes a pilot might see the mismatch without understanding its cause. Boeing's own position is that layered protections in the aircraft's design and operating environment significantly limit real-world feasibility and risk. The Wi-Fi radio's ability to beacon out to a remote attacker over the plane's in-flight network is described as a theoretical capability in the article, not as something demonstrated in a real deployment. The researchers themselves write that the lack of an immediate fix should not be cause for panic or grounding aircraft, noting that all of the paper's authors continue to fly on 737s.

“I would not sleep on this one.”

— Stefan Savage, UC San Diego