Full Report
Security researchers found that in less than 60 seconds, they could open a hatch on a plane’s exterior, plug in a tiny device, and redirect the aircraft’s autopilot or sabotage its flight plan.
Analysis Summary
# Vulnerability: Physical Implant Attack on Commercial Aircraft Avionics
## CVE Details
- **CVE ID**: Not yet assigned (Research-based disclosure).
- **CVSS Score**: N/A (High Impact/Physical Vector).
- **CWE**: CWE-1298 (Hardware Logic Design Error) / CWE-306 (Missing Authentication for Critical Function).
## Affected Systems
- **Products**: Boeing 737 (specific models like 737 Next Generation and potentially others using similar avionics architectures).
- **Versions**: Legacy and current production models utilizing standardized external maintenance ports.
- **Configurations**: Aircraft featuring external hatches that provide physical access to avionics buses (e.g., ARINC 429).
## Vulnerability Description
The vulnerability stems from a lack of authentication and encryption on internal aviation data buses. Specifically, researchers identified that external maintenance hatches on the aircraft's exterior provide a physical entry point to the plane's communication network. By connecting a custom-built, coin-sized hardware implant to these ports, an attacker can inject malicious data packets directly into the avionics bus. This allows for the manipulation of the Flight Management Computer (FMC) and the Digital Flight Control System (DFCS).
## Exploitation
- **Status**: PoC available (Developed by researchers from UC San Diego and Oberlin College).
- **Complexity**: Medium (Requires specialized knowledge of aviation protocols and hardware design).
- **Attack Vector**: Physical (Requires < 60 seconds of physical access to an exterior hatch).
## Impact
- **Confidentiality**: Low (Primary goal is injection, not data theft).
- **Integrity**: **Critical** (Ability to alter flight plans, takeoff calculations, and fuel data).
- **Availability**: **Critical** (Ability to redirect autopilot or sabotage flight systems, potentially leading to hull loss).
## Remediation
### Patches
- No software "patch" is currently available, as the flaw resides in the fundamental design of the unauthenticated ARINC protocols used in aviation.
### Workarounds
- **Physical Security**: Enhanced monitoring and locking mechanisms for exterior maintenance hatches while aircraft are on the tarmac.
- **Pre-flight Verification**: Rigorous manual cross-checking of FMC data against secondary independent sources before takeoff.
## Detection
- **Indicators of Compromise**: Discrepancies between physical instruments and digital displays; unauthorized Wi-Fi signals originating from the aircraft fuselage.
- **Detection Methods**: Implementation of Intrusion Detection Systems (IDS) for ARINC 429 buses to identify anomalous traffic patterns or unauthorized device IDs.
## References
- USENIX Security Symposium 2024: [https://www.usenix.org/conference/usenixsecurity24]
- Wired Security Analysis: [https://www.wired.com/story/this-coin-sized-device-can-hack-a-boeing-737/]