Video: https://youtu.be/t1_Xd9n0dGY?si=CwjImfGc1J5s9akJ
Physical access to an aircraft has not typically been considered a cybersecurity risk – but it should be, according to a team of computer scientists at the University of California San Diego. In a paper presented Aug. 13 at the USENIX Security Symposium in Baltimore, Md, former UC San Diego PhD student Sam Crow showed that physical access to an aircraft – even for a brief period of time – would allow an attacker equipped with a custom-made hardware device to take over the communications between two key onboard computers.
The device needs to be plugged into a port inside the plane's belly – an action that the researchers estimate would take under 60 seconds. This would require access to the aircraft either when parked at a gate or when in an airport hangar during regular maintenance. Access to these areas is controlled carefully but not always successfully, the computer scientists note in the new paper.
The researchers successfully demonstrated the attack on a testbed made of actual Boeing 737 airplane parts and airplane software. The proof-of-concept attack allowed researchers to change the plane's flight path and change data that could make takeoff conditions unsafe. But they are careful to note that the attack requires someone to do significant planning and engineering work ahead of time. The research team communicated closely with Boeing, disclosed the vulnerability in 2020, and further tested and validated their findings in Boeing's own lab.
Of note, the Boeing 737 is one of the most used aircraft in commercial aviation, with 8000 in service today. It makes up about 25% of Delta's existing fleet, 38% of American's, 53% of United's and all of Southwest Airlines' fleet. However, while the team's implementation is designed for the Boeing 737 specifically, the researchers believe their findings are relevant for the aviation industry more generally.
"Our goal with this research is to alert the aviation community to this class of risks, so they may be appropriately mitigated well before they become dangerous. All of the authors of this paper routinely travel on Boeing 737 aircraft and expect to continue doing so," said UC San Diego computer scientist and cybersecurity expert Aaron Schulman, one of the senior authors of the work.
The research team, led by Schulman and Stefan Savage, both professors in the UC San Diego Department of Computer Science and Engineering, presented their peer-reviewed work describing the vulnerability and attack Aug. 13 at the USENIX Security Symposium.
How does the attack work?
The researchers discovered an unused maintenance port located in the plane's Electronics and Equipment bay, which houses key electronic systems. This bay is located just under the plane's nose, can be reached from the ground, and isn't locked. This maintenance port provides access to the data transmitted between two critical on-board computers.
One computer is the flight management computer, which controls the plane's flight path as well as approach path before landing and also supplies critical information at takeoff. The other is the computer that displays this flight path information, along with other critical flight data for the pilots in the cockpit. Information and instructions to and from these two computers is ferried by hard-wired communication systems known as buses – in this case, two ARINC 429 buses, which were invented in 1977.
Buses, like the ARINC 429, convey data via current flowing through two wires and a set of resistors. Because the system is decades old, it does not have data security features, such as message authentication.
The researchers designed, built and programmed a small hardware device, which acts as a third-party entity that takes over these buses. It does so by driving more current so it can override any legitimate transmissions with its own. This approach allows the device to covertly transmit new instructions to the flight management computer while suppressing indications that changes have been made.
Using their proof-of-concept demonstration, the researchers showed that their implant could re-route a plane in flight or modify data about weight, balance and temperature, which could lead to an unsafe takeoff. While pilots could override such changes, it would require that they detect that a compromise had occurred.
"We believe we have made a strong case that time-limited physical access (e.g., 60 seconds) represents a realistic goal for a motivated attacker and that the consequences of even such short access can be significant (and hence worthy of attention)," the researchers write.
Design and Implementation of a Physical Implant Attack on the Boeing 737
San Crow, Pat Pannuto, Stefan Savage and Aaron Schulman, Department of Computer Science and Engineering, University of California San Diego Jacobs School of Engineering
Patrick Mercier, Department of Electrical and Computer Engineering, University of California San Diego Jacobs School of Engineering
Stephen Checkoway, Oberlin College
