This Cheap, Pocket-Sized Gadget Can Hack A Boeing 737

A gadget roughly the size of a US quarter can take over the flight computers on Boeing 737. Once in place, it does so quietly, rewriting where the plane is headed while keeping that change off the pilot’s screen. That may sound scary at first, but the thing’s actually been developed by researchers at the University of California San Diego and Oberlin College. They showed off the device – assembled for $100 in parts – in August at an academic security conference.

Specifically, the device slots into a maintenance connector inside a compartment called the Electronics and Equipment bay under a 737’s nose, where most of the plane’s computers sit. The hatch covering that compartment has no lock either and sits low enough for a bad actor to be able to reach it from the tarmac itself, without using a ladder. The whole job would take about 60 seconds, according to the researchers.

The findings cover the Boeing 737NG family, the third and most widely delivered generation of the jet, along with the MAX, the fourth generation and the one Boeing builds today. Between them, those two account for over 95% of the 737s still flying.

The connector itself works by tapping the line between the Flight Management Computer, which plots the route the autopilot follows, and the display unit the pilots type into. It’s able to do this because those two talk over a 1977 wiring standard with no authentication.

For what it’s worth, the researchers have actually never tested any of this on an actual aircraft – gaining access to one simply isn’t easy. Instead, the research was performed by buying used 737 parts and then wiring them together on a bench, following Boeing’s own schematics. Boeing isn’t oblivious to all this. In fact, the company has known about the flaw since 2020. And in 2023, the company even let the team run the attack inside its own test facility, where it worked as well. However, Boeing doesn’t seem too worried. It told Wired that the way planes get operated and the protections built into them make a real attack difficult to succeed.

The attacker would firstly need months of reverse engineering before they’re able to build anything. Even if they’re able to clear that hurdle, they’d have to defeat security by walking up to a parked 737, and then actually opening the hatch without anyone asking why.

But difficult is not the same as impossible. The Transportation Security Administration, which lawmakers established after the September 11 attacks, counted more than 1.4 million American aviation workers carrying badges for restricted airport areas in a 2017 report. That badge is all it would take for someone to gain access.

Still, even if the device is able to hide from the pilot’s screen, it doesn’t control the rest of the cockpit. If it does manage to turn the plane the wrong way, the change of direction would still show up on other instruments. A crew would catch it and simply turn autopilot off to correct the course.