Small Hidden Chip Could Let Someone Manipulate Boeing 737’s Flight Computer

Researchers built a tiny device that fits inside an existing maintenance port in the belly of a Boeing 737 and demonstrated, on a genuine Boeing 737 test setup, that it could alter the flight management computer’s route and performance data, the inputs that tell the autopilot where to fly, while hiding those changes from pilots in that test environment.

Consider a ground worker near the nose of a Boeing 737 during a routine turnaround between flights. In less time than it takes to brew a pot of coffee, that person opens an unsecured hatch on the underside of the plane, plugs a small custom-built device into an existing maintenance socket, closes the hatch, and walks away. In the test environment the researchers constructed, an implant inserted that way could quietly reroute the flight computer and feed it bad performance numbers, all without tipping off the crew.

That is not a movie plot. It is what a team of researchers from UC San Diego and Oberlin College designed, built, and tested on genuine Boeing 737 hardware. Their paper, set to be presented at the USENIX Security conference, documents what they call a new class of aviation cybersecurity threat, one that starts with less than a minute of physical access and ends with an implant interfering with one of the most safety-critical computers on the plane.

Researchers behind the work are careful to note they do not believe attacks like this are imminent. All of the authors fly on Boeing 737s regularly and say they expect to keep doing so. Their stated goal is to alert the aviation community so the risk can be addressed well before it becomes dangerous.

Inside a Boeing 737’s Unlocked Electronics Bay

Every Boeing 737 has a compartment tucked beneath the nose, just above the landing gear, called the Electronics and Equipment bay, or E&E bay. Inside it sit many of the aircraft’s key avionics computers and much of the wiring that ties them together. Getting in requires no ladder and no special tools. The hatch has no lock.

By studying maintenance videos and Boeing wiring diagrams, the researchers estimated it takes no more than 10 to 15 seconds to open the hatch. Their plan allocates another 30 seconds to insert the implant and 15 seconds to close the hatch, totaling 60 seconds of access near the front of the plane. During a short-haul turnaround, as many as a dozen different workers may be moving around a single aircraft at once, among them baggage handlers, caterers, fuel crews, and mechanics. At the time the paper was written, the researchers noted that a basic airport ground crew job often requires only a high school diploma and a standard background check.

Inside the E&E bay, the researchers identified an open maintenance socket, originally designed to give technicians access to key data lines for testing. That socket gives access to the communication channels between two critical systems: the flight management computer, which calculates the flight plan and commands the autopilot, and the keyboard-and-screen terminal the pilots use to interact with that computer.

How the ‘Bus Driver’ Attack Hijacks the 737

To understand how the implant operates, it helps to know that aircraft systems communicate by sending data along shared electrical wires. On the Boeing 737, these wires use a standard called ARINC 429, which has been in commercial aviation since 1977. It was designed with reliability in mind, but the researchers found that same reliability carries a hidden weakness.

ARINC 429 uses small electrical components at each transmitting device to limit how much current that device can push onto the wire. The implant exploits that limit. By connecting directly to the wire without those same restrictions and using stronger amplifiers, the device can push more current than the legitimate transmitter, effectively drowning out the real signal and replacing it with whatever message the attacker chooses. At the same time, by measuring how much current flows through the wire, the implant can decode what the legitimate device was trying to send in the first place.

Researchers call this the “Bus Driver” attack. It gives the implant the ability to intercept messages, read them, and swap them for altered versions, all without any physical cutting or splicing of wires. Previous research had assumed this kind of takeover on ARINC 429 was extremely difficult without physically unplugging the original transmitter. This paper shows that a small, purpose-built device tapped into the right maintenance connector can pull it off.

What the Implant Could Do to a Boeing 737

Working with a genuine 737 flight management computer that once flew on a Southwest Airlines aircraft and a multifunction control and display unit, the cockpit terminal pilots use, taken from a Batavia Air 737, the researchers built a bench-top test setup that matched Boeing’s own wiring schematics. Boeing later allowed the team to test their prototype in the company’s own 737 testing facility, where the attack worked as expected.

In testing, the implant demonstrated three specific ways it could interfere with the flight computer and the pilots’ display, each of which the researchers flagged as a serious safety concern.

First, it could change the flight route. When pilots activate autopilot during cruise, the plane follows programmed waypoints. In the test setup, the implant could add a new waypoint directing the aircraft somewhere else, confirm the change on the pilot’s behalf, and then suppress both the indicator light and the updated screen information that would reveal what happened. From the pilot’s vantage point on the test display, nothing would appear to have changed.

Second, it could alter weight and balance data. Before every takeoff, the flight computer calculates critical performance figures, including safe departure speeds, based partly on the aircraft’s total weight. The implant could silently change that weight figure in the test setup, potentially skewing the takeoff settings the computer calculates, such as engine thrust and flap position, the figures a crew relies on for a safe departure.

Third, it could manipulate the assumed outside air temperature the computer uses to set takeoff performance margins. Lowering that figure shrinks the safety buffer built into those settings.

In all three scenarios, the implant could at the same time freeze or alter what pilots see on their screen, hiding any trace of the changes in the test setup.

A Spy Chip That Hides Inside a Dust Cap

Researchers also solved two practical engineering challenges for anyone wanting to deploy such a device: power and concealment. The maintenance socket itself provides constant electrical power, both on the ground and in the air, so the implant needs no battery. They designed a custom circuit board small enough to fit almost entirely inside the socket’s protective cap, the cover that sits over the port when it is not in use. Tucked beneath that cap, the implant can sit undetected and wait.

Built into the design is Wi-Fi capability, raising the possibility that an implant could connect through the cabin’s in-flight Wi-Fi to receive instructions from a remote operator, though the team could not test that capability.

Acquiring the genuine 737 components needed to build and test the prototype, including the actual avionics units, cost under $20,000, carried out primarily by a single graduate student.

Fixing this class of problem is not simple. Removing the maintenance socket entirely would eliminate its usefulness for legitimate technicians. Redesigning the entire ARINC 429 system, an approach used in military aviation, would block the Bus Driver attack but would mean replacing communication hardware on every aircraft still using that standard. Adding software-based message authentication would help but would create a thorny problem around managing secure codes when hardware is swapped or updated. Detection through electrical monitoring is possible but requires hardware not present in commercial aircraft today.

Boeing received the initial disclosure in April 2020, followed by detailed presentations over the next few years. In-person hardware testing at Boeing’s facility, delayed by the COVID-19 pandemic, took place in December 2023. In a statement included in the paper, Boeing said its technical experts “are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks.”

Researchers say they cannot independently verify how far Boeing has addressed the vulnerability in aircraft already flying, part of why they chose to publish while leaving out specifics that would make the attack easier to copy. That open question is the heart of their argument: a risk this serious deserves attention while it remains a laboratory demonstration rather than something an attacker has actually attempted.

Disclaimer: This article describes cybersecurity research conducted on a laboratory testbed built from genuine Boeing 737 components and later validated at a Boeing testing facility. The researchers did not install the device on an in-service passenger aircraft or interfere with any active flight. They disclosed their findings to Boeing in 2020 and deliberately withheld technical details that would make the attack easier to reproduce. Boeing states that existing layers of protection significantly limit the real-world feasibility of such an attack. StudyFinds reports on scientific research and does not endorse or provide guidance for any activity described here.