How the Bus Driver Attack Works

The researchers — led by former UCSD Ph.D. student Sam Crow — designed, built, and programmed a small circuit board that acts as a malicious third-party device inserted between two critical onboard computers . Here is how the attack unfolds:

Physical Installation in Under 60 Seconds

The device, roughly the size of a U.S. quarter and costing under $100 to build, is installed by opening an external hatch on the aircraft's fuselage that accesses the Electronics and Equipment (E&E) bay . An attacker can open this hatch in about 15 seconds with no special tools, then plug the implant into an exposed Onboard Maintenance Computer (OMC) port . The entire process takes less than 60 seconds, and the device is small enough to hide under the port's dust cap, remaining invisible during routine inspections .

Exploiting the ARINC 429 Avionics Bus

Once connected, the implant taps into the unencrypted ARINC 429 avionics data bus, a single-master serial bus that carries all communication between the Flight Management Computer (FMC) and the pilot's Multifunction Control and Display Unit (MCDU) . ARINC 429 has no built-in authentication or encryption. Crucially, its electrical design uses impedance-matching resistors that allow a malicious device to electrically override legitimate signals by driving more current onto the bus lines than the authorized transmitter . The researchers call this signal-suppression technique the "Bus Driver" attack .

What the Implant Can Alter

Once the Bus Driver implant overrides the bus, it can inject spoofed commands to:

• Change waypoints and divert the aircraft from its programmed flight path
• Alter takeoff weight calculations, which directly affects V-speeds (the rotation speed required for takeoff)
• Modify outside air temperature and fuel quantity values, which changes critical performance calculations

Stealth: The Spoofed Pilot Display

Simultaneously, the device sends fake data to the cockpit displays so the pilot sees the original, unaltered flight plan — effectively hiding all changes . The pilot would see no alert or discrepancy on the MCDU screen, making the attack extremely difficult to detect from the cockpit .

Wi-Fi Control in Flight

The implant includes a Wi-Fi radio, allowing an attacker to send commands wirelessly in real-time or even deploy a malicious software update while the aircraft is in flight . This means the device can be dynamically controlled from the moment it is installed through the entire duration of the flight.

Boeing's Response

The research team first disclosed the vulnerability to Boeing in 2020, then worked closely with the manufacturer to test and validate the attack in Boeing's own lab .

In response, Boeing released a statement that downplayed the practical risk: "Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks" . Boeing also stated that it carried out its own review of the relevant component designs, installations, and interfaces in response to the researchers' findings .

Recommended Mitigations

The researchers proposed a series of mitigations to address the vulnerability, including :

• Physically blocking access to the external OMC/service port, such as with lockable panels or tamper-evident seals
• Improving electrical isolation on the ARINC 429 bus to make bus-driving attacks more difficult
• Adding cryptographic authentication to ARINC 429 messages
• Implementing sensor fusion and cross-checking so that discrepancies between flight parameters would be detected by redundant systems
• Improving cockpit alerting so pilots are notified of mismatches between the FMC and display data

The researchers emphasized that their findings do not necessitate grounding the fleet, but rather call for practical, near-term improvements to physical security and avionics bus integrity .

How the Bus Driver Attack Works

The researchers — led by former UCSD Ph.D. student Sam Crow — designed, built, and programmed a small circuit board that acts as a malicious third-party device inserted between two critical onboard computers . Here is how the attack unfolds:

Physical Installation in Under 60 Seconds

The device, roughly the size of a U.S. quarter and costing under $100 to build, is installed by opening an external hatch on the aircraft's fuselage that accesses the Electronics and Equipment (E&E) bay . An attacker can open this hatch in about 15 seconds with no special tools, then plug the implant into an exposed Onboard Maintenance Computer (OMC) port . The entire process takes less than 60 seconds, and the device is small enough to hide under the port's dust cap, remaining invisible during routine inspections .

Exploiting the ARINC 429 Avionics Bus

Once connected, the implant taps into the unencrypted ARINC 429 avionics data bus, a single-master serial bus that carries all communication between the Flight Management Computer (FMC) and the pilot's Multifunction Control and Display Unit (MCDU) . ARINC 429 has no built-in authentication or encryption. Crucially, its electrical design uses impedance-matching resistors that allow a malicious device to electrically override legitimate signals by driving more current onto the bus lines than the authorized transmitter . The researchers call this signal-suppression technique the "Bus Driver" attack .

What the Implant Can Alter

Once the Bus Driver implant overrides the bus, it can inject spoofed commands to:

• Change waypoints and divert the aircraft from its programmed flight path
• Alter takeoff weight calculations, which directly affects V-speeds (the rotation speed required for takeoff)
• Modify outside air temperature and fuel quantity values, which changes critical performance calculations

Stealth: The Spoofed Pilot Display

Simultaneously, the device sends fake data to the cockpit displays so the pilot sees the original, unaltered flight plan — effectively hiding all changes . The pilot would see no alert or discrepancy on the MCDU screen, making the attack extremely difficult to detect from the cockpit .

Wi-Fi Control in Flight

The implant includes a Wi-Fi radio, allowing an attacker to send commands wirelessly in real-time or even deploy a malicious software update while the aircraft is in flight . This means the device can be dynamically controlled from the moment it is installed through the entire duration of the flight.

Boeing's Response

The research team first disclosed the vulnerability to Boeing in 2020, then worked closely with the manufacturer to test and validate the attack in Boeing's own lab .

In response, Boeing released a statement that downplayed the practical risk: "Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks" . Boeing also stated that it carried out its own review of the relevant component designs, installations, and interfaces in response to the researchers' findings .

Recommended Mitigations

The researchers proposed a series of mitigations to address the vulnerability, including :

• Physically blocking access to the external OMC/service port, such as with lockable panels or tamper-evident seals
• Improving electrical isolation on the ARINC 429 bus to make bus-driving attacks more difficult
• Adding cryptographic authentication to ARINC 429 messages
• Implementing sensor fusion and cross-checking so that discrepancies between flight parameters would be detected by redundant systems
• Improving cockpit alerting so pilots are notified of mismatches between the FMC and display data

The researchers emphasized that their findings do not necessitate grounding the fleet, but rather call for practical, near-term improvements to physical security and avionics bus integrity .