60 Seconds to Hack an Airplane 🥷✈️

A research paper from UC San Diego and Oberlin College tests what that assumption actually costs when hacking Boeing 737 airplane. (More about it below)

How the scenario works?

The title is was:

Design and Implementation of a Physical Implant Attack on the Boeing 737.

The claim was simply if someone with a custom board gets about sixty seconds next to a 737 on the ground, they can seat a hardware implant in an existing maintenance connector, leave the airframe looking untouched, and later sit in the middle of the wires between the flight management computer and the screen the captain is staring at.

They demonstrated it on genuine 737 parts. Boeing later let them run a version of the prototype in Boeing's own lab. It worked there too😱.

Physical access was supposed to be out of scope

The Avionics (Navigation or Radio Communication systems) assumes a usually secure airport and physical tampering is unrealistic. However, some people argue that accessing the airplane through helper jobs is not difficult, the researchers argue for considering brief, time-limited physical access.

A small implanted device is different from a bomb or swapped component because it can be non-destructive, concealed, persistent, and potentially remotely accessible later. The research does not claim aircraft can currently be hijacked remotely, nor that such attacks are happening in the wild, but needs little mistake (which attackers in real scenarios realy wait it).

The main proposal is simply to expand the threat model to account for short windows of physical access.

A minute is a maintenance problem, not a movie problem

Notice that tampering with wiring or replacing major avionics in 30 seconds is impractical and likely may leave detectable errors that airplane staff could alarm. The real question is what an attacker could accomplish during normal airport access windows 30 to 60 minute turnarounds, overnight stays, or maintenance periods. Airports have many authorized workers and millions of security badges, so "nobody unauthorized can get near the aircraft" is not a reliable assumption. An attacker might not sneak onto the ramp; they could legitimately obtain a job and badge that gives them access. However, the researchers spent years acquiring and reverse-engineering Boeing 737 avionics and building a test environment called Triton… So their broader point is that, just like cars have exposed diagnostic ports, aircraft have maintenance/diagnostic interfaces too; located in a bay under the nose.

The hatch, the bay, the connector they will not name

The Electronics and Equipment (E&E) bay is underneath the aircraft's nose and can be accessed from the ground. Opening the hatch triggers a cockpit indicator, but the indicator turns off when the hatch closes, meaning a brief access period may leave little evidence.

Furthermore, the researchers estimated an attack could fit into roughly one minute: opening the hatch, installing the device, and closing it. Inside, they found a maintenance connector that provides access to ARINC 429 communication buses connecting the flight-management computer and cockpit display. This is significant because the attacker wouldn't need to splice individual wires; the connector provides access to the relevant communication paths. One path could potentially redirect the flight-management computer's button inputs to an external device. The display path, however, was only tapped, meaning a simple implant could inject commands but wouldn't necessarily be able to hide what it was doing from the pilot.

Bus Driver, in English

The implant first copies the pilot's display, then freezes or falsifies what the pilot sees which makes horrors and scares the airplane staff. It separately sends commands to the flight-management computer, allowing the aircraft's actual state to differ from what the captain's display presents.

They demonstrated three potentially serious changes:

• Route: The implant could insert a waypoint and confirm the change, potentially causing the aircraft to turn toward an unintended destination.
• Zero-fuel weight (ZFW): It could alter the aircraft's assumed weight, affecting takeoff speeds, thrust, fuel calculations, and performance margins.
• Assumed temperature: It could change a takeoff-performance setting, potentially reducing the intended safety margin.

The key danger isn't that pilots become physically unable to control the aircraft. It's that they may be shown believable but false information, making detection difficult. The Ryanair 4978 example is used to illustrate the broader concept: a diversion doesn't necessarily require physical destruction; it could result from changing the route while deceiving the people responsible for noticing it.

They did this with real boxes, then Boeing's boxes

They got real 737 avionics components that had been flown before and wired them as Boeing's docs said. They made a small implant that fits in the maintenance connector and draws power from it. The prototype had a radio too, but they didn't test the wireless part on an actual plane. The whole project cost under $20,000 for hardware and was mostly built by one grad student, which shows you don't need a huge budget for this kind of research.

In 2020, the researchers started telling Boeing about their findings, and in 2023, they did hands-on testing at a Boeing 737 facility. The findings were also discussed with U.S. aviation-security organizations, airlines, and suppliers. Boeing responded that it evaluated the relevant systems and believes existing physical, operational, and technical protections reduce the feasibility and risk of real-world attacks. However, Boeing's wording, " limit", doesn't mean the attack is impossible. The researchers also couldn't figure out on their own if the vulnerability is still the same on planes that are currently being used.

What you would actually do about this?

The problem isn't just the aircraft hatch, it's the maintenance connector that's the issue, and the access it gives to avionics buses. Physical solutions include blocking or removing unused connectors and limiting maintenance connector access to the flight-management system.

ARINC 429, commonly used in commercial aviation, is compared to MIL-STD-1553, which is often used in military aviation. MIL-STD-1553's electrical isolation makes certain types of bus manipulation more difficult.

Anomalies like unusual voltage or noise, and current spikes from an implant, are what other proposed defenses would try to detect. Preventing unauthorized commands is theoretically possible with cryptographic authentication, and it's not entirely out of the question. Procedural defenses are used too: if the captain's system seems compromised, the crew could use the first officer's system; they manually verify the route. That fix isn't permanent because it relies on the second system staying secure.

Resources

The paper Crow, Checkoway, Mercier, Pannuto, Savage, Schulman. Design and Implementation of a Physical Implant Attack on the Boeing 737. USENIX Security 2026. https://www.usenix.org/system/files/usenixsecurity26-crow.pdf https://www.usenix.org/conference/usenixsecurity26/presentation/crow