A $100 part, an unlocked hatch, 60 seconds: the 737's exposed surface is physical

Researchers at the University of California San Diego and Oberlin College built a coin-sized device that costs under $100 and can take over communications between two key flight computers on Boeing 737 aircraft, plugged into a maintenance port in the electronics bay under the nose ^[1][2]. That bay is reached from the ground through an exterior hatch that is not locked and is routinely accessible to maintenance workers and other airport staff, and the researchers estimate installation takes 60 seconds ^[23][3].

The paper, presented this week at the USENIX Security Symposium in Baltimore, lands against an industry habit: much of aviation cybersecurity attention goes to network-based threats, while this attack needs little time and little money ^[4][5]. The researchers wrote that their goal is to alert the aviation community to this class of risk so it can be mitigated "well before they become dangerous" ^[6].

What sits on the wire matters more than the wire. The device interposes between the Flight Management Computer, which manages the flight plan and supplies information used during takeoff, and the Multipurpose Control Display Unit that pilots use to control it ^[7]. That position lets it change a flight plan while suppressing the change on the pilot's display ^[8]. The described scenarios include the autopilot diverting the aircraft into another country's airspace or simply flying off course ^[9]. The researchers also demonstrated manipulation of weight, balance and outside air temperature values, the inputs that make a takeoff safe or unsafe ^[10]. The prototype is Wi-Fi enabled, which the researchers say could theoretically let it join the aircraft's in-flight Wi-Fi and be driven remotely over the internet ^[24].

The scale is not marginal. UC San Diego puts roughly 8,000 737s in service, and the type accounts for about 25 percent of Delta's fleet, 38 percent of American's, 53 percent of United's and the whole of Southwest's ^[11][12]. Across those four carriers the exposure runs from a quarter of the fleet to all of it ^[18]. The researchers frame the finding as pointing to a broader industry-wide risk rather than one manufacturer's defect ^[13].

The disclosure timeline is the part operators should read twice. The researchers first alerted Boeing in 2020 and kept working with the company for several years after, and they say they do not know whether Boeing has fixed the vulnerability ^[14][15]. Five-plus years of engagement have ended without confirmed remediation ^[20]. Boeing did not immediately respond to Gizmodo but told Wired it had reviewed the findings and considers existing safeguards sufficient, saying its technical experts are confident that "the layers of protection in place on the airplane, including within the system design and the operating environment, provide sufficient mitigation to significantly limit the feasibility and risk of real-world attacks" ^[19][21].

The researchers do not oversell it. They concede the attack would require significant planning and engineering expertise, and that an attentive pilot could recover from most of what they tested; all of the authors say they routinely fly on 737s and will continue to ^[16][17]. Their proposed fixes are unglamorous and cheap: tighter control over who can reach a parked aircraft, or filling the vulnerable port with epoxy, or removing it entirely ^[22].

Watch whether any airline or regulator treats ramp access as a security boundary rather than a logistics problem, and whether the epoxy fix shows up in a service bulletin. A remedy that costs a few dollars per airframe and never appears is the clearest signal of where this actually sits on the priority list.