🔎 Last updated · Editorial policy · Report an error
TL;DR: Why Avionics Data Links Are Still Aviation’s Weakest Digital Perimeter
Aviation’s data links—ACARS and CPDLC—were engineered for availability, not confidentiality or integrity. A decade after Pen Test Partner’s Boeing 757 research demonstrated ACARS-triggered commands reaching engine management systems, these protocols remain largely unauthenticated. The attack surface isn’t theoretical; it’s broadcast in the clear over most of the northern hemisphere, and the industry’s certification cycle is only now catching up.
Avionics 101: What ACARS and CPDLC Actually Do
Every commercial flight you’ve taken exchanged hundreds of text messages with ground systems before the wheels left the runway. Most of that traffic traveled over the Aircraft Communications Addressing and Reporting System (ACARS)—a digital datalink standard dating to 1978, when ARINC (now part of Collins Aerospace) introduced it to automate time-consuming voice reports between crews and airline operations.
ACARS carries operational messages: engine performance reports (OOOI events—Out, Off, On, In), fuel state, maintenance fault codes pulled from onboard systems, weather requests, gate assignments, and reroute instructions. Controller-Pilot Data Link Communications (CPDLC), by contrast, is the air traffic control application—a text-based replacement for VHF and HF voice position reports, altitude clearances, and oceanic routings.
The critical distinction for security practitioners: ACARS is airline/operations-oriented, while CPDLC is an ATC safety-of-flight service. But both share the same fundamental trust model—messages are plain text, unauthenticated at the link layer, and accepted by avionics on arrival. Voice radio at least gives a human the ability to hear another human; data link messages get parsed and acted on by machines.
How ACARS Works: VHF, HF, Satellite, and the Ground Network
ACARS is bearer-agnostic. A message from the ground to an aircraft can arrive via any of three paths:
- VHF — The dominant mode over land. Aircraft transmit around 131 MHz (channelized; 131.550 MHz and adjacent frequencies carry ACARS in various regions), and a network of ground stations relays traffic. Range is essentially line-of-sight, roughly 200 nautical miles from a well-sited station.
- HF — Long-range fallback using the HFDL protocol (high frequency data link) on frequencies like 6.517, 8.912, and 11.184 MHz, primarily for oceanic and polar routes.
- Satellite — Inmarsat and Iridium bearers (SATCOM datalink) cover oceanic routes, with Iridium Certus now replacing legacy SwiftBroadband-era links on modern retrofit programs.
Between aircraft and airline, two service providers historically dominated: ARINC (the Americas and Pacific, via its GLOBALink network) and SITA (Europe, Middle East, Asia). The ground segment is a store-and-forward message network—a cold-war-era architecture where a message from dispatch to a tail number is routed through provider gateways without cryptographic assurance at any hop.
The message format itself is plain text. Aircraft are addressed by registration or flight ID, and message sublabels (M1A, Q0, etc.) indicate the application. If you can position an antenna, you can inject—or at minimum spoof—the appearance of legitimate traffic. That fact sits at the center of everything that follows.
The Pen Test Partner 757 Research: What Was Actually Demonstrated
At the Hack In The Box conference in Amsterdam in 2015 (with follow-on disclosure in 2016), researchers from UK consultancy Pen Test Partner—working with pilot and researcher Hugo Teso’s earlier “PlaneSploit” groundwork as context—presented research performed on a full Boeing 757 simulator and, via a cooperative owner, a physical 757 airframe.
The verified findings: the team showed that ACARS messages could be used to trigger commands on the aircraft’s Electronic Flight Bag (EFB) and related avionics units, reaching the Engine Indicating and Crew Alerting System (EICAS) and engine management displays. In the simulator, they demonstrated manipulating engine display information—including thrust indications—via crafted ACARS input. On the physical 757, they confirmed connectivity between the data link domain and onboard systems, communicating with the aircraft through its legitimate radio pathways.
What they did not demonstrate: remote takeover of flight controls, spoofed navigation data in flight, or manipulation of a certified aircraft in operational service. The work was conducted responsibly, disclosed to Boeing and the FAA, and both organizations publicly acknowledged engagement with the research. Boeing’s statement at the time was emphatic that the path shown did not compromise flight controls of aircraft in service—a claim the researchers themselves did not dispute. The demonstration ran against lab and museum-condition hardware, not a revenue fleet.
Why the Research Mattered: The Attack Chain Explained
The significance wasn’t a headline-grabbing takeover. It was the proof of a specific architectural property: the data link domain is routable to safety-relevant avionics domains. For blue-team threat modeling, the chain decomposes cleanly:
- Reach: ACARS ground stations and SATCOM links are accessible from public positions; VHF range is line-of-sight but stations are dense, and satellite bearers are global.
- No authentication: Nothing in the classic ACARS message format cryptographically binds a message to a legitimate sender. Spoofed messages from dispatch or a weather service are indistinguishable at the avionics interface.
- Processing: Airborne avionics parse and act on messages—displaying them, logging them, and in some configurations feeding downstream systems.
- Cross-domain flow: The 757 research showed information flow from the data link/EFB domain into EICAS and engine management displays—domains certified with the assumption of isolation.
- Persistence of the pattern: Any system that trusts link-layer input inherits the link’s trust model. That’s the transferable lesson.
This is the same failure pattern OWASP catalogs for application security—client-side trust, missing integrity checks—but transplanted into a safety-certified environment. CISA’s guidance on aviation communications security and its work with the FAA on avionics cybersecurity make the same point in softer language: legacy datalinks were not designed with adversaries in the threat model.
Replicating the Mechanics: Observing ACARS in a Lab
You don’t need a 757 to study this attack surface—the traffic itself is broadcast in the clear and can be lawfully received in most jurisdictions. A practical lab setup:
- Hardware: An RTL-SDR Blog V3 dongle (~$35) with a simple VHF whip or dipole antenna. Position it near an airport or at elevation for best coverage.
- VHF ACARS decoding:
acarsdec(multi-channel decoder by Thierry Leconte) oracarsdeco2from the acarsdec family; for VDL Mode 2 (the higher-rate ACARS subnetwork), usedumpvdl2. - HFDL:
dump1090-style tools don’t apply here—usehfdlfrom the krakenrfid/dumphfdl lineage (dumphfdl) with an HF-capable SDR such as an SDRplay RSP1A. - Public feeds: If you lack RF coverage, sites like airframes.org and live ACARS map services expose real decoded traffic, which doubles as ground truth for your own decodes.
Sample decoded output from acarsdec looks like:
ACARS mode: 2, E: 0, label: H1, block id: 7, ack: N Flightid: BA0118 Msg no: M31A, seq: 2 Message:-- #M1B/BAY1 .EGBBKAUA/SEA /POS N052.27.7 W001.56.3 /FL 340 /GS 485 /ETA 2015
That’s a real position report: flight, registration, position, flight level, groundspeed, ETA—all unencrypted, all unauthenticated. Practitioners should log messages on a common frequency for an hour and count how many plausible spoofing targets pass through: weather requests, reroutes, gate changes, maintenance reports. Every one of them is a message type an attacker could imitate.
CPDLC: The Next-Generation Data Link With the Same Trust Model
CPDLC exists in two flavors. FANS 1/A—the Boeing/Airbus implementation from the 1990s—runs ACARS-style messaging over satellite and HF for oceanic ATC, mandatory equipment on North Atlantic tracks above certain altitudes. ATN B1, the ICAO-defined Aeronautical Telecommunications Network variant, is the European standard using VDL Mode 2, with the UK’s NATS and Eurocontrol mandating datalink (DLS) in core European airspace since 2020.
The problem: CPDLC inherits its trust model from ACARS. FANS 1/A messages ride the same unauthenticated datalink. ATN B1 adds some application-layer structure, but neither standard deploys cryptographic message authentication between aircraft and ATC. Eurocontrol’s own security work and ICAO’s Doc 9869 and the upcoming ATN IPS (Internet Protocol Suite) standards acknowledge that message integrity protection is a gap; the ATN IPS architecture under ICAO’s 2023+ amendment cycle finally specifies PKI-based security, but deployment timelines stretch into the 2030s for most operators. Meanwhile, CPDLC clearances—altitude changes, route amendments—remain, at the protocol level, spoofable text.
Threat Model for Practitioners: Who Can Reach These Links and How
Skeptical framing matters here, because aviation security attracts both dismissal and hysteria. A calibrated threat model:
- VHF attacker: Requires line-of-sight to an aircraft or a ground station. Range at 131 MHz is a few hundred kilometers from altitude; a ground-position attacker covers traffic near an airport. Cheap and feasible.
- SATCOM attacker: Requires legitimate satellite access or an uplink-capable terminal—significantly higher cost and legal exposure, but geographically unconstrained.
- Ground network attacker: Compromise of a service provider (ARINC/Collins, SITA) or airline ops center gateway yields trusted injection at scale—historically the most realistic and most underexamined position.
- IFE/avionics segmentation: Post-research, manufacturers tightened segregation between passenger IFE and avionics, but the EFB/data link boundary remains the porous one. Assume vendor networks and dispatch systems are in-scope for an attacker.
What is not realistic, absent nation-state resources and insider knowledge of specific airframe configurations: reaching flight control computers directly through ACARS. Certification under DO-178C partitions safety-critical software from non-essential domains precisely for this reason. The realistic harms are operational disruption (spoofed messages causing confusion or workload), disinformation to crews, data exposure, and abuse of systems that trust link input—serious, but not Hollywood.
Industry Response: Standards, Segmentation, and What Changed After 2015
The legitimate response arrived through the standards channel, not patch deployment. RTCA DO-326A and its EUROCAE twin ED-202A established airworthiness security certification guidance; DO-355/ED-204 addressed continuing airworthiness; DO-356A/ED-203A covered security assurance methods. ARINC 822 (the “Onboard Security” standard) and AEEC activity on datasel and message authentication have worked toward authenticated datalink, and the FAA’s 14 CFR 25.1319 amendments and special conditions on new aircraft now require cybersecurity assessments for networked systems.
Why a decade without a fix? Certification economics. Avionics changes require re-certification under DO-178C/DO-254, airframes have 25–30 year service lives, and fleet-wide retrofits cost operators millions per type. Availability-first design means any authentication mechanism that could reject a legitimate safety message creates a failure mode worse—by certification math—than accepting an occasional spoof. Security is being engineered in at the next architectural generation (ATN IPS), not retrofitted to the installed base.
Blue Team Takeaways: Lessons for Securing Legacy Protocols
Strip out the airplanes and the 757 research is a case study in legacy protocol risk applicable to ICS, medical, and industrial environments:
- Assume no authentication in design review. Audit any protocol that accepts input over a radio bearer or shared network as if a hostile sender wrote every message.
- Segment safety-critical from operational systems—and verify the boundary. The finding that mattered was cross-domain information flow, not the link itself.
- Monitor for anomalous message injection. Unexpected ACARS labels, out-of-region dispatch identities, or messages during unusual flight phases are detectable anomalies worth alerting on—correlate ground logs against what avionics received.
- Treat vendor and provider networks as in-scope. Your threat model must include the service provider’s gateway, because your trust anchor lives there.
CTF and Learning Path: Building Avionics Security Skills
Aerospace security is an undersupplied skill set, and the entry path is inexpensive. Start with the SDR stack above: an RTL-SDR Blog V3, a VHF antenna, and acarsdec or dumpvdl2 will have you decoding live traffic in an afternoon. Progress to dumphfdl for HF and study SATCOM signaling via public research (for example, the CCSDS standards and academic work on Inmarsat Aero signaling). Read DO-326A and DO-356A to understand certification thinking—the constraints matter as much as the vulnerabilities. Communities worth following include the OpenSky Network, SDR enthusiasts documenting VDL2 decodes, and aviation security sessions at DEF CON (the Aircraft/DataDuplex villages) and AIAA/IEEE aerospace security workshops. Build the habit that matters: model what a system trusts, then ask who else can occupy that trust position.
Frequently Asked Questions
Can ACARS messages really control aircraft systems?
The Pen Test Partner research demonstrated ACARS-triggered commands reaching the EFB domain and, from there, affecting engine management and EICAS displays on a 757 simulator and lab-condition airframe. This proved routability between the data link domain and safety-relevant display systems—not remote flight control takeover. The researchers, Boeing, and the FAA all agreed full flight-control compromise was not demonstrated, and the partitioning required by DO-178C certification makes that path substantially harder than the one shown.
Is CPDLC encrypted or authenticated?
Effectively neither, at the protocol level. CPDLC over FANS 1/A rides unauthenticated ACARS-style messaging; ATN B1 adds application-layer structure but limited cryptographic protection. Integrity depends on procedural controls rather than cryptography. The ICAO ATN IPS standard finally specifies PKI-based message authentication, but fleet deployment will take years—spoofing and integrity concerns persist across the installed base today.
How can I listen to ACARS traffic legally?
VHF ACARS is unencrypted and publicly decodable. An RTL-SDR dongle with acarsdec or dumpvdl2 on 131.550 MHz and adjacent channels will produce readable traffic in most populated regions. Receiving is legal in most jurisdictions (the US, most of the EU), though rules on disclosure or use of intercepted content vary—check your national telecom regulations before publishing decoded material. HF and satellite interception carry additional restrictions in some countries.
Why is aviation so slow to patch these vulnerabilities?
Certification cycles, airframe lifetimes, and cost. Any avionics change requires recertification; airframes serve 25–30 years; retrofits run to millions per fleet type. More fundamentally, availability-first design means an authentication scheme that could reject a legitimate safety message introduces a hazard worse than accepting an occasional spoof. The fix is arriving architecturally—via ATN IPS and DO-326A-lineage certification requirements—rather than as a patch.
{
“@context”: “https://schema.org”,
“@type”: “Article”,
“headline”: “From ACARS to CPDLC: How Data Links Became Aviation’s Attack Surface After Pen Test Partner’s 757 Research”,
“description”: “A deep dive into avionics data link security: how ACARS and CPDLC work, what Pen Test Partner’s 757 research actually showed, and why these attack surfaces remain unresolved a decade later.”,
“author”: {“@type”: “Organization”, “name”: “Hmmnm – Cybersecurity Tutorials”},
“publisher”: {“@type”: “Organization”, “name”: “Hmmnm”},
“about”: [“ACARS”, “CPDLC”, “Aviation Security”, “Avionics”, “SDR”]
}
Related reading
- Decode ADS-B with dump1090 and Wireshark: Spoof-Test Your Own Aircraft Feed Safely
- Exploit BOLA and IDOR in Your Own MCP Server: A Burp Suite Agent-Tool Lab
