How the attack works: Physical access and implantation

An attacker begins by opening an unsecured hatch on the aircraft's exterior—the Electronics and Equipment (E&E) bay—in roughly 15 seconds with no special tools . Inside, a diagnostic maintenance port used by ground crews for testing and troubleshooting avionics is directly wired to the Flight Management Computer (FMC) and the cockpit's Multipurpose Control Display Unit (MCDU) over the ARINC 429 bus .

The researchers' custom device, which is roughly the size of a coin (slightly larger than a U.S. quarter), plugs into this port and fits entirely under the existing dust cover, rendering it invisible during casual inspection. The total installation takes under 60 seconds .

Once connected, the device uses a technique the researchers call 'Bus Driver'—sending signals at a higher electrical current to override and replace genuine commands transmitted between the FMC and MCDU. Because the ARINC 429 protocol has no encryption or authentication, the device can intercept, modify, and inject messages without detection . The device also includes a Wi-Fi module, allowing an attacker to control it remotely through an aircraft's onboard Wi-Fi network .

Specific manipulations the device can perform

The 'Bus Driver' device grants an attacker several forms of control over the aircraft's avionics:

• Alter autopilot waypoints: The device can make small, incremental changes to the flight plan's waypoints. Over time, these stealthy modifications can gradually divert the aircraft from its intended route without triggering pilot alerts .
• Change takeoff variables: The device can modify critical inputs used by the FMC to calculate takeoff performance, such as aircraft weight and outside air temperature. If the FMC registers a lower weight or higher temperature than reality, it may calculate insufficient thrust for a safe takeoff .
• Spoof pilot displays: The device simultaneously corrupts the data shown on the instruments in the cockpit, hiding the modifications. The pilot sees false but plausible values, making it difficult to detect the attack .

Potential consequences

The researchers warn that these capabilities could lead to serious outcomes:

• Runway overruns on takeoff due to tampered weight/temperature values .
• Diversion of the aircraft into foreign or restricted airspace .
• Catastrophic crashes in worst-case scenarios .

Boeing's response and timeline

Boeing stated it is 'confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks' . However, the researchers report that Boeing was first notified of elements of the research more than six years ago, around 2020, and has not disclosed any specific technical fix to address the vulnerability .

Recommended mitigations

The researchers propose both short-term physical fixes and longer-term engineering solutions:

Short-term physical fixes

• Fill the external maintenance port with epoxy to block physical access .
• Remove the connector entirely from the aircraft .

Long-term software/hardware fixes

• Implement software-based detection to identify anomalous signals on the avionics bus .
• Add cryptographic authentication to ARINC 429 communications to prevent message spoofing .

Despite the severity of the demonstration, the researchers emphasize that they continue to fly on Boeing 737s themselves. They are not calling for grounded aircraft but instead advocate for long-term industry planning to address this class of physical-access avionics attacks .

How the attack works: Physical access and implantation

An attacker begins by opening an unsecured hatch on the aircraft's exterior—the Electronics and Equipment (E&E) bay—in roughly 15 seconds with no special tools . Inside, a diagnostic maintenance port used by ground crews for testing and troubleshooting avionics is directly wired to the Flight Management Computer (FMC) and the cockpit's Multipurpose Control Display Unit (MCDU) over the ARINC 429 bus .

The researchers' custom device, which is roughly the size of a coin (slightly larger than a U.S. quarter), plugs into this port and fits entirely under the existing dust cover, rendering it invisible during casual inspection. The total installation takes under 60 seconds .

Once connected, the device uses a technique the researchers call 'Bus Driver'—sending signals at a higher electrical current to override and replace genuine commands transmitted between the FMC and MCDU. Because the ARINC 429 protocol has no encryption or authentication, the device can intercept, modify, and inject messages without detection . The device also includes a Wi-Fi module, allowing an attacker to control it remotely through an aircraft's onboard Wi-Fi network .

Specific manipulations the device can perform

The 'Bus Driver' device grants an attacker several forms of control over the aircraft's avionics:

• Alter autopilot waypoints: The device can make small, incremental changes to the flight plan's waypoints. Over time, these stealthy modifications can gradually divert the aircraft from its intended route without triggering pilot alerts .
• Change takeoff variables: The device can modify critical inputs used by the FMC to calculate takeoff performance, such as aircraft weight and outside air temperature. If the FMC registers a lower weight or higher temperature than reality, it may calculate insufficient thrust for a safe takeoff .
• Spoof pilot displays: The device simultaneously corrupts the data shown on the instruments in the cockpit, hiding the modifications. The pilot sees false but plausible values, making it difficult to detect the attack .

Potential consequences

The researchers warn that these capabilities could lead to serious outcomes:

• Runway overruns on takeoff due to tampered weight/temperature values .
• Diversion of the aircraft into foreign or restricted airspace .
• Catastrophic crashes in worst-case scenarios .

Boeing's response and timeline

Boeing stated it is 'confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks' . However, the researchers report that Boeing was first notified of elements of the research more than six years ago, around 2020, and has not disclosed any specific technical fix to address the vulnerability .

Recommended mitigations

The researchers propose both short-term physical fixes and longer-term engineering solutions:

Short-term physical fixes

• Fill the external maintenance port with epoxy to block physical access .
• Remove the connector entirely from the aircraft .

Long-term software/hardware fixes

• Implement software-based detection to identify anomalous signals on the avionics bus .
• Add cryptographic authentication to ARINC 429 communications to prevent message spoofing .

Despite the severity of the demonstration, the researchers emphasize that they continue to fly on Boeing 737s themselves. They are not calling for grounded aircraft but instead advocate for long-term industry planning to address this class of physical-access avionics attacks .