That is because physical access to an aircraft – even for a brief period of time – could allow an attacker equipped with a custom-made hardware device to take over the communications between the two key onboard computers, according to a team of computer scientists at the University of California San Diego.
An attacker would need to plug the device into a port inside the plane’s belly – an action researchers said could take under 60 seconds.
Researchers successfully demonstrated the attack on a testbed made of actual Boeing 737 airplane parts and airplane software. The proof-of-concept attack allowed researchers to change the plane’s flight path and change data that could make takeoff conditions unsafe.
Planning Ahead
But they noted the attack requires someone to do significant planning and engineering work ahead of time. The research team communicated closely with Boeing, disclosed the vulnerability in 2020, and further tested and validated their findings in Boeing’s own lab.
Of note, the Boeing 737 is one of the most used aircraft in commercial aviation, with 8,000 in service today. It makes up about 25 percent of Delta’s existing fleet, 38 percent of American’s, 53 percent of United’s and all of Southwest Airlines’ fleet.
However, while the team’s implementation is for the Boeing 737 specifically, the researchers believe their findings remain relevant for the aviation industry more generally.
“Our goal with this research is to alert the aviation community to this class of risks, so they may be appropriately mitigated well before they become dangerous,” said UC San Diego computer scientist and cybersecurity expert Aaron Schulman, one of the senior authors of the work. “All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so.”
Computer science professor Aaron Schulman interacts with one of the aircraft computers the researchers were able to take over.
Source: Erik Jepsen/University of California San Diego
Schulman and Stefan Savage, both professors in the UC San Diego Department of Computer Science and Engineering led the research team.
The researchers discovered an unused maintenance port located in the plane’s Electronics and Equipment bay, which houses key electronic systems. This bay is just under the plane’s nose, can end up reached from the ground, and does not have a lock. This maintenance port provides access to the data transmitted between two critical on-board computers.
Computers Affected
One computer is the flight management computer, which controls the plane’s flight path as well as approach path before landing and also supplies critical information at takeoff.
The other is the computer that displays this flight path information, along with other critical flight data for the pilots in the cockpit. Information and instructions to and from these two computers ends up ferried by hard-wired communication systems known as buses – in this case, two ARINC 429 buses, created in 1977.
Buses, like the ARINC 429, convey data via current flowing through two wires and a set of resistors. Because the system is decades old, it does not have data security features, such as message authentication.
The researchers designed, built and programmed a small hardware device, which acts as a third-party entity that takes over these buses. It does so by driving more current so it can override any legitimate transmissions with its own.
This approach allows the device to covertly transmit new instructions to the flight management computer while suppressing indications there were changes.
Using their proof-of-concept demonstration, the researchers showed their implant could re-route a plane in flight or modify data about weight, balance and temperature, which could lead to an unsafe takeoff. While pilots could override such changes, it would require they detect that a compromise had occurred.
“We believe we have made a strong case that time-limited physical access (e.g., 60 seconds) represents a realistic goal for a motivated attacker and that the consequences of even such short access can be significant (and hence worthy of attention),” the researchers wrote in the paper.