This Tiny $100 Device Can Hack a Boeing 737

This coin-size device can hack a Boeing 737,

redirecting its autopilot's navigation,

or changing key values in its flight plan.

The security researchers who built it

say their proof-of-concept hacking technique

could potentially cause anything from flights commandeered

into another country's aerospace to catastrophic crashes.

But as terrifying as this research sounds,

it's actually designed to make air travel safer.

Let me explain.

This week at the USENIX Cybersecurity Conference,

researchers from UC San Diego and Oberlin College

are presenting perhaps the most practical

plane-hacking technique ever to be made public.

To carry it out, they used a wifi-enabled prototype

that's about the size of a quarter

and cost less than $100 to make.

The researchers say that in less than a minute,

this hardware implant can be fitted onto a port

that's accessible from the exterior of a Boeing 737,

one that's often well within the reach

of maintenance workers or other staff between flights.

Once it's installed, the device can send electrical signals

to the plane's internal network

that spoof commands to sensitive computer systems

that manage the flight plan,

changing the navigation followed by its autopilot,

or tampering with values like the plane's weight

or the outside temperature,

both of which are critical for takeoff calculations.

The results could be a method of sabotaging a plane

with more control, stealth, and deniability

than traditional attacks, like an explosive device.

The researchers' hacking device was not expensive to make,

but showing that it works has not been cheap or easy.

In fact, the researchers spent a decade

acquiring tens of thousands of dollars worth

of Boeing's computer components for testing.

They also worked closely with Boeing

to share their findings,

disclosing parts of their research more than six years ago,

and even demonstrating their findings in a Boeing test lab.

Boeing told Wired it carried out its own review

in response to the researcher's work,

and downplayed the practical risk

of this physical access hacking technique.

The researchers say Boeing hasn't told them

about any technical fix

for the vulnerabilities they uncovered.

But by going public with their findings now,

they want to show that this sort of hacking technique

represents a serious blind spot in aviation security.

They hope the results, long term,

will be a redesign of airplane systems

to prevent the kind of attack they demoed.

And in the short term,

they suggest removing the port they targeted from airplanes,

or simply plugging it with epoxy,

simple measures that would make this kind

of plane hacking impossible

before it can be pulled off at 40,000 feet.

For more on the researchers' plane hacking work,

read our full story at wired.com.