A device slightly larger than a coin, cost less than 100 dollarsinserted into a port accessible from the outside of the fuselage: this is enough to give orders to the autopilot of a Boeing 737 and to falsify what the pilot sees on their screens. It was built by a group of security researchers from University of California, San Diego and of theOberlin Collegewho spent years putting the aircraft’s onboard electronics back together piece by piece.
The port is behind an external door that is not locked and transports data between the Flight Management Computerthe calculator that keeps the flight plan, and the cockpit display unit. “If you had 60 seconds with a plane, what could you do?” he summed it up Stefan Savagethe UC San Diego professor who led the project. “It turns out that there is a door accessible from the outside. You can get there without any special tools in about 15 seconds. And you can stick a piece of electronics in there that’s a little bigger than a quarter that basically lets you tell the autopilot what to do and lie to the pilot about changes to the flight plan.”
Years rebuilding the 737’s nervous system
The starting point was the purchase and assembly, component by component, of the 737’s computers, until the aircraft’s nervous system was recreated in the laboratory. The inspiration comes from the cloning devices that criminals apply to ATMs to steal card data: if a physical device is enough to intercept that traffic, then even an airplane can be attacked by connecting to the bus internal system that connects its components. The Boeing wiring diagrams then indicated the exact place to insert.
Once connected, the device can dock the On-board Wi-Fiand this transforms an operation done on the ground into a remote control channel. From there the flight plan, the values used for take-off calculations and those of the fuel become editable. The same data shown on the pilot’s screen can be altered, so that no one in the cabin notices the tampering. “It’s like finding the damn Death Star exhaust,” Savage said.
From the missed takeoff speed to the course deviated by three degrees
An incorrect external temperature or a distorted load and passenger weight lead the crew to calculate an incorrect rotation speed and not take off in time before the end of the runway. At the other extreme, a sudden change in navigation can bring the aircraft into a bump. Between the two extremes is silent manipulation: “It could be something subtle: you’re on the Pacific, you see blue everywhere, and it diverts you from three degrees off course, and now you’re in the middle of nowhere,” he explained Aaron Schulmanthe other UC San Diego faculty member involved in the work.
To worry Beau Woodsformer consultant to the US Cybersecurity and Infrastructure Security Agency and Boeing’s Industry Cyber Technical Council, is the profile of who could physically carry out the operation. “It’s entirely possible for a staff person to walk up to an airplane while it’s on the ground, undergoing maintenance, and stick something like that in there,” he noted. Dozens of workers pass around a parked aircraft every day whose access to the fuselage does not arouse any suspicion, and it is exactly the position that the attack requires.
The researchers shared their findings with Boeing six years ago and have been working with the company on the vulnerability ever since. To date, they say, the manufacturer has not communicated any corrections to them, and they believe it is probable that none have yet been applied: commercial airplanes are rarely redesigned, and the distance between a report and the actual modification of an on-board system is measured in years. At the moment there is no CVE identifier assigned in the available sources, nor a public statement from Boeing on the work.
In the paper the researchers wrote that “all the authors of this work regularly travel on Boeing 737 and plan to continue to do so”. Savage, however, adds an indication aimed at those who manage the planes: “It’s something that the aviation industry will want to plan to defend itself from. I wouldn’t underestimate it.”
