Security researchers have found a way to hack a Boeing 737 with a device no bigger than a coin. The 737 is one of the most widely used airliners in the world, so chances are you’ve flown on one yourself at least once. The attack requires installing a small device in a port that’s accessible through a hatch on the outside of the plane. According to the researchers, this port is regularly within reach not just of maintenance crews, but of other airport and airline staff too. And installing the device takes less than 60 seconds. So let’s talk about what this mysterious little device actually is, what it can do, and whether it’s still safe to fly on a Boeing 737. Why hacking a plane is harder than hacking a car Most of us have gotten used to the idea that our computers and phones can be hacked. It’s probably the most common topic on this blog. But we’ve also covered attacks on less common targets: cars , robot lawnmowers , automated card shufflers , bikes , and even mattresses . In today’s world, all of these (and many other) devices contain tiny (or not-so-tiny) computers. Airplanes are no exception. A modern airliner is packed with computers — some of which handle critical functions: from calculating takeoff parameters to controlling the flight itself. But there’s one key difference: airliner manufacturers, unlike the makers of most smart home gadgets, take security very seriously, which makes it far harder to reach these systems from the outside. Maybe that’s precisely why the idea of hacking a real plane has been tempting the most inquisitive security researchers for years. A team at the University of California San Diego and Oberlin College — the researchers who finally pulled it off — spent more than a decade wrestling with the problem. As mentioned above, the main challenge in hacking a plane is that its critical systems aren’t connected to the external internet. Because of that, studying plane-related attack vectors wasn’t seen as especially promising within the cybersecurity research community: reaching isolated systems remotely is extremely difficult, and the odds of an attacker gaining physical access were considered very low. Two other successful projects changed that assumption for UC San Diego researchers Kirill Levchenko and Aaron Schulman: a hack of the Chevrolet Impala , and research into payment card skimmers . The car hack led their team to buy secondhand Boeing 737 computer components and build their own test rig. The skimmer research gave them the idea for a small physical device that could plug directly into the plane’s internal systems. After studying the Boeing 737’s circuit diagrams, the researchers found a port accessible from outside the plane — protected only by an unlocked hatch. That port connects to a data channel called the ARINC 429 bus, which links the plane’s flight management computer (FMC) to its multifunction control and display unit (MCDU) . The port sits in the electronics bay beneath the cockpit. From outside the plane, it’s covered only by an unlocked hatch. Source [alt-title] How to reach the Boeing 737’s port [/alt-title] The port sits in the electronics bay beneath the cockpit. From outside the plane, it’s covered only by an unlocked hatch. Source A “bus driver” at the controls On their test rig, the researchers checked what would happen if they connected to the ARINC 429 bus through this port and sent electrical signals more powerful than the ones the Boeing’s components normally exchange with one another. It turned out that doing so let them override legitimate commands with their own. From there, all that was left was building a device small enough to fit into the port they’d found. Step by step, the team built a device compact enough to slot into the unprotected port. The finished version set them back less than US$100, and appears to have been built largely from off-the-shelf parts: a small microcontroller, electronics for communicating with the bus, and a Wi-Fi module. That last p…