The researchers aren’t revealing which port they targeted on the 737, nor are they releasing some details of how their hacking device is able to spoof commands to the plane’s computers. They’ve worked closely with Boeing to share their findings, first disclosing elements of their research to the company more than six years ago, and going so far as to test out and demonstrate their attack in a Boeing facility’s test lab.
When WIRED reached out to Boeing about the researchers’ work, it responded in a statement that it had carried out its own review of its components’ designs, installations, and interfaces in response to the researchers’ findings. But it downplayed the practical risk of their physical-access hacking technique. “Our technical experts are confident that the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks,” the statement reads.
For their part, the researchers say, Boeing hasn’t told them about any technical fix for the vulnerabilities they’ve discovered—and they speculate that the company may not in fact implement any such update to their systems for years to come, given how rarely commercial airplanes are redesigned.
That lack of an immediate security update for planes shouldn’t be cause for panic or grounding aircraft, they write in their paper. “All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so,” the introduction of the paper reads.
Savage argues, though, that the research has demonstrated the need for long-term changes in both the cybersecurity of airplane components and, perhaps more immediately, the operational security measures that determine who can access a plane while it’s on the ground. Their simplest fix suggestion: Plug the port with epoxy, or remove it altogether.
“This is something the aviation industry will want to plan to defend against,” Savage says. “I would not sleep on this one.”
Building a Plane, Then Breaking It
This particular team of researchers’ interest in hacking a plane originated nearly a decade and a half ago, when some of them discovered and demonstrated the first successful over-the-internet techniques for hacking a car’s computer systems, including its steering and brakes. Their proof-of-concept attack methods, particularly ones carried out by exploiting a Chevy Impala’s OnStar system, launched an era of automotive hacking research that ultimately led to a sea change in carmakers’ cybersecurity practices, including launching bug bounty programs for cars and hiring car hackers to help them root out vulnerabilities.
In the wake of that car-hacking work, one member of the team, then UCSD research scientist Kirill Levchenko, suggested they try hacking airplanes next. But unlike a Chevy Impala, a Boeing 737 was well beyond their budget. “I pointed out that we can’t exactly buy a plane and put it in the parking lot, but he was undeterred,” Savage says.
Over the following years, the team began buying computer components from that commercial aircraft whenever they could find them for sale, spending tens of thousands of dollars to acquire the equipment on the secondhand market. By 2019 they had assembled what they called Triton, an “avionics test bed” that essentially consisted of wired-together 737 computer parts.
