A proof-of-concept attack on the Boeing 737 ARINC 429 hack has demonstrated that a device small enough to conceal in a pocket can be slipped into an unlocked maintenance port and used to freeze pilot displays, overwrite flight data, or reprogramme the autopilot entirely. The work, which researchers have named the “Bus Driver” attack, targets the ARINC 429 data bus that connects the aircraft’s flight management computer to the cockpit’s control and display unit.
ARINC 429 is the workhorse protocol of commercial aviation. Unlike the multi-transmitter buses familiar to anyone who has poked around a CAN bus or an I²C line, ARINC 429 uses a single transmission source per channel. That single-source architecture was long thought to make a transmission-override attack practically impossible without physically swapping out a legitimate transmitter such as a flight management computer, which is the sort of task that requires both time and authorisation. As it turns out, the assumption was wrong.
How the Boeing 737 ARINC 429 hack actually works
The key is a pair of 37.5-ohm resistors that sit in series with each ARINC 429 transmitter. By connecting an attack device to the same line and transmitting at sufficient power, that device can simply override the legitimate transmitter’s signal. The resistors, designed as a protection measure, inadvertently provide the electrical headroom an attacker needs.
To demonstrate the technique, the researchers built a test rig using components standard to the 737: a GE 2907A4 flight management computer (FMC), a GE 577F1 multipurpose control and display unit (MCDU), and an Integrated Flight Systems Accessory Unit (IFSAU), all wired together as they would be on the aircraft. After analysing the ARINC 429 traffic flowing between the FMC and the MCDU (the unit pilots use to programme the autopilot and run takeoff calculations) the team was able to freeze the pilot’s display, overwrite what it showed, or silently alter the values the MCDU received and presented.
Three attack scenarios follow from that capability. The most dramatic would reprogramme the autopilot to fly toward a new waypoint. A subtler and arguably more dangerous variant would modify the weight-and-balance figures held in the FMC: those values underpin takeoff performance calculations, and even modest errors can compromise flight safety. A third option is simply denying the pilots access to the display altogether. Crucially, on the fly-by-cable 737, pilots retain full manual control of the aircraft throughout, which the researchers note may make the 737 comparatively safer than some fly-by-wire types in this specific scenario.
An unlocked port under the nose
Theory is one thing; physical access is another. Tapping directly into ARINC 429 wire bundles is awkward because individual wires are difficult to identify inside large looms, and the protocol includes probes to detect misbehaving devices on the bus. The researchers found a more convenient route. According to UC San Diego Today, an open maintenance port with access to the ARINC 429 bus is located in the aircraft’s Electronics and Equipment (E&E) bay, positioned just beneath the plane’s nose. The bay can be reached from the ground, and it is not locked.
The attack device they designed to exploit that port is a small ESP32 board, the same class of microcontroller beloved by homebrew electronics enthusiasts everywhere. It plugs directly into the data port. Once in place, it communicates with an operator over Wi-Fi. The researchers estimate the device can be inserted in 30 to 60 seconds by someone on the ground, with no ladder required. Determining where the device came from after the fact, they note, would be extremely difficult.
As StudyFinds reports, the researchers dubbed the whole approach the Bus Driver attack, a name that captures both the bus-level intervention and the effect of putting an unauthorised hand on the controls. While the 737 is the specific aircraft in the proof of concept, the researchers make clear that nothing in the technique is unique to that airframe: other aircraft using ARINC 429 could face the same exposure.
The research is a pointed reminder that even a protocol engineered around a single trusted transmitter carries assumptions worth challenging. For anyone who has spent time with a logic analyser on older serial protocols, the underlying principle will feel familiar: if you can put enough power on the line, you can talk over the legitimate device. Aviation just raises the stakes considerably higher than a hobbyist bus sniffer ever did. Boeing has not commented publicly on the findings, and the researchers note that access to aircraft on the ground remains poorly restricted.
