A $100 Coin-Sized Device Can Hijack A Boeing 737

It's getting pretty hard to fly these days. Global conflicts are covering heavily trafficked routes with GPS jamming. For reasons unknown, people keep blinding pilots with powerful laser pointers from the ground. And now the military is shooting down drones with really powerful lasers, which is so dangerous to planes that the FAA keeps shutting down airspace because of it. Still, at least these are all external threats. It's not like the actual plane itself is being messed with, or that the pilots are getting faulty messages in the cockpit about the status of the aircraft. That would be very bad. Especially if it could be done with the 60-second installation of a $100 device into an unlocked maintenance connector. So, guess what?

Cybersecurity researchers at the University of California, San Diego and Oberlin College have released a paper detailing how to install a $100 device into an unlocked maintenance connector in 60 seconds. They only tested it in a mock-up of a Boeing 737's avionics, so this exact method might not work on every single plane. Still, the 737 is one of the most popular airliners of all time, so it's a pretty wide threat. This research has been going on for a while, so the team warned Boeing about this threat fully six years ago. Hopefully, now that the paper is public and everybody knows how this hack works, the 737 is at least safe? "Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks," Boeing told Wired in a statement.

Even if that's the case, this capability represents an entirely new threat vector. Previously, a hypothetical attack on a plane's physical security was seen as highly technical and very time intensive. In other words, only a few organizations would be capable of even attempting it, and somebody would probably notice if someone was fiddling with a plane for that long. This new attack is cheap, quick, and easy. Sneak somebody into an airport and throw an orange vest on them, and they could walk up to a plane and plug this device into it. Done. Yikes.

So what exactly is this device? Made with off-the-shelf components, this coin-sized object plugs into what's called the Open Maintenance Connector (OMC). Basically, this is where ground crew can connect to the plane's avionics and do diagnostics or whatever else they need to do. While this isn't its intention, it can technically be used mid-flight if something were plugged in and left there, which is where this new device comes in. Among other things, the OMC is a middleman between the Flight Management Computer, which calculates important things like weight and autopilot flightpath, and the actual cockpit display that the pilots read. Essentially, the device overrides the computer's actual signal and replaces it with... whatever the device wants. In other words, the computer will be thinking one thing about weight or trajectory, but the pilot's display will be saying something completely different.

Taking off without knowing accurate weight can lead to crashes. Wayward autopilot, over unmarked areas like the ocean, could send a plane hundreds of miles off course, potentially leading to a crash if there's not enough fuel on board. In a conflicted world, it could even send a plane into a no-fly zone, which could lead to it getting shot at. That's a lot of danger for $100.

The research team's paper goes into much more detail, but the basic idea is that the computer's electrical signal isn't very powerful from a wattage perspective. So this attack device just sends a much stronger signal at the exact same moment, effectively yelling over the true signal with its own fake one. The cockpit display therefore only "hears" (receives) the yelled signal, not the quiet original one. The device can thus both send its own commands to the computer (change the flightpath, etc) and ensure the display doesn't reflect these changes, keeping the pilots oblivious.

Before you cancel your flights, the research team went out of its way to say that they all still fly on Boeing 737s. They don't think this is an imminent threat. Again, Boeing has already stated that there are defenses in place to mitigate this attack. Also, the team tested this on a mock-up of a 737's avionics, not an actual, fully featured plane. The point here is less "We're all doomed" and more "But this is a real vulnerability that no one has previously accounted for." It's time to start accounting for it.

(One last thing, for all you Sons of Anarchy fans: The researcher who developed the attack device, a grad student, is named Sam Crow. I did not know biker gangs were interested in avionic cybersecurity, but you learn something new every day!)