How the "Bus Driver" attack works

The device is physically plugged into a maintenance port in the plane's Electronics and Equipment bay, located under the nose and accessible from the ground behind an unlocked hatch. The researchers estimate it takes under 60 seconds to gain access and connect the device .

The port carries data between the Flight Management Computer (FMC) and the pilot's Multi-purpose Control Display Unit (MCDU) over two ARINC 429 buses — a hard-wired communication standard dating to 1977 that lacks message authentication or encryption .

The implant acts as a "bus driver" by driving more current on the bus than the legitimate computers, allowing it to override any transmissions and inject its own spoofed commands. It can also suppress indications on the pilot's display that changes have been made .

What the device can alter

• Autopilot waypoints and flight path: The implant can re-route the plane in flight, including diverting it to a different country's airspace or changing its navigation by just a few degrees .
• Takeoff variables: It can modify data for aircraft weight, balance, center of gravity, and outside air temperature — all of which are used to calculate safe takeoff speeds. Incorrect values could lead to a runway overrun or loss of control .
• Pilot displays: The device can spoof the results shown to pilots so they see no indication a change has occurred, potentially tricking them into making dangerous decisions .

Boeing's response

The researchers first disclosed the vulnerability to Boeing in 2020 and later validated their findings in a Boeing test facility . Boeing confirmed it carried out a review of its components' designs and interfaces, and told WIRED that "the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks" . The researchers say Boeing has not told them about any technical fix. They speculate the company may not implement an update for years, given how rarely commercial airplanes are redesigned .

Mitigations the researchers recommend

• Physical hardening: The simplest fix is to plug the maintenance port with epoxy or remove it entirely .
• Improved operational security: The researchers argue for tighter access controls around aircraft on the ground, since the attack requires brief physical access to the plane's exterior hatch .
• Longer-term system redesign: Because the ARINC 429 bus lacks authentication, the researchers suggest that future avionics buses should include security features like message authentication to prevent spoofing .

The researchers note that while the attack is serious and demonstrates a significant blind spot in aviation cybersecurity, it does not warrant grounding aircraft or public panic — all of the authors state they "routinely travel on Boeing 737 aircraft and expect to continue doing so" .

How the "Bus Driver" attack works

The device is physically plugged into a maintenance port in the plane's Electronics and Equipment bay, located under the nose and accessible from the ground behind an unlocked hatch. The researchers estimate it takes under 60 seconds to gain access and connect the device .

The port carries data between the Flight Management Computer (FMC) and the pilot's Multi-purpose Control Display Unit (MCDU) over two ARINC 429 buses — a hard-wired communication standard dating to 1977 that lacks message authentication or encryption .

The implant acts as a "bus driver" by driving more current on the bus than the legitimate computers, allowing it to override any transmissions and inject its own spoofed commands. It can also suppress indications on the pilot's display that changes have been made .

What the device can alter

• Autopilot waypoints and flight path: The implant can re-route the plane in flight, including diverting it to a different country's airspace or changing its navigation by just a few degrees .
• Takeoff variables: It can modify data for aircraft weight, balance, center of gravity, and outside air temperature — all of which are used to calculate safe takeoff speeds. Incorrect values could lead to a runway overrun or loss of control .
• Pilot displays: The device can spoof the results shown to pilots so they see no indication a change has occurred, potentially tricking them into making dangerous decisions .

Boeing's response

The researchers first disclosed the vulnerability to Boeing in 2020 and later validated their findings in a Boeing test facility . Boeing confirmed it carried out a review of its components' designs and interfaces, and told WIRED that "the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks" . The researchers say Boeing has not told them about any technical fix. They speculate the company may not implement an update for years, given how rarely commercial airplanes are redesigned .

Mitigations the researchers recommend

• Physical hardening: The simplest fix is to plug the maintenance port with epoxy or remove it entirely .
• Improved operational security: The researchers argue for tighter access controls around aircraft on the ground, since the attack requires brief physical access to the plane's exterior hatch .
• Longer-term system redesign: Because the ARINC 429 bus lacks authentication, the researchers suggest that future avionics buses should include security features like message authentication to prevent spoofing .

The researchers note that while the attack is serious and demonstrates a significant blind spot in aviation cybersecurity, it does not warrant grounding aircraft or public panic — all of the authors state they "routinely travel on Boeing 737 aircraft and expect to continue doing so" .