--- title: Researchers Hack An Airline Analog | daily.dev description: Security researchers demonstrated a proof-of-concept attack against the ARINC 429 avionics bus used in Boeing 737 aircraft, exploiting the fact that... canonical: https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Researchers Hack An Airline Analog | daily.dev og:description: Security researchers demonstrated a proof-of-concept attack against the ARINC 429 avionics bus used in Boeing 737 aircraft, exploiting the fact that... og:url: https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy og:image: https://api.daily.dev/og/posts/ON1Ix4lzy.png og:image:alt: Researchers Hack An Airline Analog og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Researchers Hack An Airline Analog **[Hackaday](https://daily.dev/sources/hackaday)** · 3 min read · 0 upvotes · 0 comments ## Summary Security researchers demonstrated a proof-of-concept attack against the ARINC 429 avionics bus used in Boeing 737 aircraft, exploiting the fact that transmitters sit behind resistors that can be overpowered by an injected signal. Using off-the-shelf components including a GE flight management computer, multipurpose control and display unit, and an ESP32-based tapping device inserted into an open maintenance port, they were able to freeze or overwrite the pilot's display, alter weight and balance data, and even reprogram autopilot waypoints. The tap device, controlled over WiFi, could reportedly be installed in 30-60 seconds without a ladder, though pilots retain physical control of the aircraft as a safety backstop. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can an attacker override a legitimate transmitter on the ARINC 429 avionics bus? ARINC 429 transmitters sit behind a pair of 37.5 ohm resistors, so an attack device can transmit on the same line and simply overpower the legitimate transmitter's signal, without needing to physically replace hardware like a flight management computer. This was demonstrated using a GE 2907A4 flight management computer and GE 577F1 multipurpose control and display unit found on Boeing 737 aircraft. _daily.dev surfaces avionics and embedded bus security research like this for engineers tracking real-world attack techniques._ ### What physical device did researchers use to tap into a Boeing 737's ARINC 429 bus? A tiny ESP32-based board was designed to plug into an open maintenance port in the 737's electronics bay, operating over WiFi. It could reportedly be inserted in 30 to 60 seconds by someone on the ground without a ladder, and tracing its origin afterward would be extremely difficult given poor physical access restrictions on aircraft. _daily.dev keeps embedded security practitioners current on hardware tap and implant techniques like this ESP32 exploit._ ### What attacks were demonstrated by manipulating the ARINC 429 link between an FMC and MCDU? Researchers froze or overwrote the pilot's multipurpose control and display unit, altered weight and balance values in the flight management computer, and reprogrammed the autopilot to a new waypoint. Pilots retained full physical control of the fly-by-cable 737, but the researchers noted the attacks could still create unsafe flight conditions. _daily.dev helps engineers assessing safety-critical bus protocols stay on top of findings like this ARINC 429 demonstration._ ## Similar posts on daily.dev - [The mistold story of a software failure that grounded 6,000 jets](https://daily.dev/posts/the-mistold-story-of-a-software-failure-that-grounded-6-000-jets-kc4f7h1se) · CSO Online · 0 upvotes · 0 comments - [I built my own plane radar on a $20 ESP32 display, and I haven't opened Flightradar24 since](https://daily.dev/posts/i-built-my-own-plane-radar-on-a-20-esp32-display-and-i-haven-t-opened-flightradar24-since-xmqgp9hla) · XDA Developers · 0 upvotes · 0 comments - [Reviving TEMPEST Attacks With An Injected Signal](https://daily.dev/posts/reviving-tempest-attacks-with-an-injected-signal-l2tkji9qb) · Hackaday · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#iot](https://daily.dev/tags/iot), [#embedded](https://daily.dev/tags/embedded), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Researchers Hack An Airline Analog","url":"https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy"},"datePublished":"2026-08-16T08:08:11.006Z","dateModified":"2026-08-16T08:09:16.024Z","description":"Security researchers demonstrated a proof-of-concept attack against the ARINC 429 avionics bus used in Boeing 737 aircraft, exploiting the fact that...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5235a9f4292673a012efb9698a7570db?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5235a9f4292673a012efb9698a7570db?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hackaday","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hackaday","logo":"https://media.daily.dev/image/upload/s--JhDfhy70--/f_auto,q_auto/v1767541814/logos/hackaday","url":"https://daily.dev/sources/hackaday"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,iot,embedded,reverse-engineering","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hackaday","item":"https://daily.dev/sources/hackaday"},{"@type":"ListItem","position":3,"name":"Researchers Hack An Airline Analog"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/researchers-hack-an-airline-analog-on1ix4lzy#faq","mainEntity":[{"@type":"Question","name":"How can an attacker override a legitimate transmitter on the ARINC 429 avionics bus?","acceptedAnswer":{"@type":"Answer","text":"ARINC 429 transmitters sit behind a pair of 37.5 ohm resistors, so an attack device can transmit on the same line and simply overpower the legitimate transmitter's signal, without needing to physically replace hardware like a flight management computer. This was demonstrated using a GE 2907A4 flight management computer and GE 577F1 multipurpose control and display unit found on Boeing 737 aircraft. daily.dev surfaces avionics and embedded bus security research like this for engineers tracking real-world attack techniques."}},{"@type":"Question","name":"What physical device did researchers use to tap into a Boeing 737's ARINC 429 bus?","acceptedAnswer":{"@type":"Answer","text":"A tiny ESP32-based board was designed to plug into an open maintenance port in the 737's electronics bay, operating over WiFi. It could reportedly be inserted in 30 to 60 seconds by someone on the ground without a ladder, and tracing its origin afterward would be extremely difficult given poor physical access restrictions on aircraft. daily.dev keeps embedded security practitioners current on hardware tap and implant techniques like this ESP32 exploit."}},{"@type":"Question","name":"What attacks were demonstrated by manipulating the ARINC 429 link between an FMC and MCDU?","acceptedAnswer":{"@type":"Answer","text":"Researchers froze or overwrote the pilot's multipurpose control and display unit, altered weight and balance values in the flight management computer, and reprogrammed the autopilot to a new waypoint. Pilots retained full physical control of the fly-by-cable 737, but the researchers noted the attacks could still create unsafe flight conditions. daily.dev helps engineers assessing safety-critical bus protocols stay on top of findings like this ARINC 429 demonstration."}}]} ```