A Weapon That Clears Security

By Dolev Aviv, Lead Cybersecurity Researcher, CYVIATION

It happened twice this year. On 15 January 2026, a passenger on Turkish Airlines flight TK1853 from Istanbul to Barcelona set their hotspot name to “I have a bomb.” When a crew member saw it, the Airbus A321 and its 148 passengers declared an emergency, drew a NATO quick-reaction fighter escort, and were taken to an isolated stand in Barcelona and searched. There was no bomb, only a name in a network list. Months later, on 30 May 2026, United flight UA-236 from Newark to Palma de Mallorca turned back over the Atlantic because a passenger’s Bluetooth device was named “BOMB.” It belonged to a teenager. The passengers reached Mallorca more than nine hours late.

A single diversion costs an airline five to six figures. Most run into the tens of thousands of dollars, and a long-haul turnback like UA-236’s climbs higher still. One wide-body diversion in 2016 came to about $150,000, with fuel, crew, and re-accommodation included.

Both of these were jokes. Nobody on board had any real capability, and nothing actually happened. Someone typed a word into a phone, and that was enough to put fighter jets alongside a commercial airliner and to turn another one around over the Atlantic.

That is where this article starts. We want to raise awareness of a risk that boards every flight in plain sight, inside the pockets and bags of the people sitting in the cabin. If a name in a network list can cause that much disruption, it is worth asking what the same device can do in the hands of someone who actually knows how to use it.

Every passenger carries a potential weapon, and walks it straight through security without anyone noticing. On its own it is just a mobile phone. But it is built from the same parts an attacker uses to break into networks: a Wi-Fi radio, a Bluetooth radio, and the firmware that drives them. None of those parts are limited to the job they were sold to do. With software anyone can download, and without any special skill, that phone becomes capable of harming other passengers, interrupting the pilots, and interfering with the equipment they depend on.

Our research shows this is no longer a hypothetical issue. The technical findings that once stayed inside academic papers and security talks have become a real concern for the aircraft itself. The reason the barrier is so low is well documented: as seen, by the assessment of the field’s own researchers, the aircraft was never designed with security in mind.

A note on scope. This is an educational article. Every technique in it is either shown on a dedicated lab bench, never on an operational flight, or drawn from already-published research. Where a detail would make an attack easier to carry out, we hold it back and share it only with the relevant regulators and manufacturers, so that raising awareness does not itself create a risk.

Cyber Risk Is a SAFETY Risk

In this article we will show how the mobile phone turned into a safety issue for airlines, using only known and demonstrated attacks and techniques commonly used by adversaries every day. We describe how each attack links to a direct safety issue that affects not only the financial loss of the airlines, but the passengers’ safety as well.

We must realize that cybersecurity does not only equal data or financial loss. In aviation, a cybersecurity risk can very well become a safety hazard, no less than a bomb strapped to a terrorist. The consensus must change, and the regulators are only starting to grasp it now, with EASA Part-IS. Hopefully, this will only be the beginning.

The Main Culprit

The Nexus 5 used throughout this research, running Kali NetHunter on stock hardware. Photo: CYVIATION lab.

Today, with the advancement of nano technology, hacking tools and devices have become as small as a credit card, but these might be detected by a skilled airport security employee. What we want to focus on is that the best attack tool can be hidden in plain sight, like a standard mobile phone. Undetected, small, and inexpensive.

Specifically, we want to showcase the Nexus 5 smartphone, the legendary Android mobile phone, built by LG in 2013. This ordinary-looking smartphone, priced starting at $349 at debut, looks and feels like an everyday, simple smartphone in every aspect, but to tech enthusiasts it can be weaponized into a powerful attack tool.

Let’s start by examining the Wi-Fi chip in that phone, the BCM4339.

The BCM4339, the Wi-Fi chip inside the Nexus 5.

This chip can be unlocked with a simple installation of a firmware called NexMon. This process can be done by anyone. There are even detailed guides and videos on how to do this yourself, and with the rise of AI, it’s even easier. All you need is the phone, no additional special tools.

This update unlocks a region in the phone that turns it into a software-defined radio. It primarily operates across standard 2.4 GHz and 5 GHz Wi-Fi bands, granting full, low-level physical and media access control layer control on the device, thus allowing attackers to use offensive techniques which have existed for over 20 years, such as:

Stealthy Packet Sniffing & Credential Harvesting:

Standard mobile devices cannot see the Wi-Fi traffic of other devices. NexMon forces the chip into Monitor Mode.

• Traffic Interception: Attackers capture all raw unencrypted data floating through the air. Put simply: anything your device sends without protection, they get a copy of.
• Credential Theft: They sniff cleartext HTTP passwords, DNS queries, and email traffic. What that means: they can read your passwords, your emails, and every site you visit.
• Target Profiling: Without transmitting anything at all, they build a picture of which devices are present, what kind of devices they are, and which services each one talks to. In practice: they learn who is in the cabin and what is running on their phones, without ever touching a single device.

Advanced Man-in-the-Middle (MitM) & Frame Injection:

NexMon unlocks Frame Injection, allowing the chip to construct and transmit custom, malicious Wi-Fi frames.

• Deauthentication Attacks: Attackers flood a network with spoofed “disconnect” commands, kicking legitimate users off their Wi-Fi. Put simply: they can drop you off the network and block you using it whenever they feel like it.
• Evil Twin Exploits: Once a user is kicked, the attacker hosts a fake clone of the network with the same name, tricking the victim into connecting to the hacker’s machine. What that means: you reconnect to what looks like the same network, and from then on everything you do goes through them.
• WPA/WPA2 Handshake Cracking: Injecting frames forces devices to re-authenticate, allowing the attacker to capture the cryptographic handshake and crack the Wi-Fi password offline. In practice: they force your device to log in again, record it happening, and crack the password to the network later at their leisure.

Sustained Disruption:

The frames cost the attacker almost nothing to send, so disruption can be held open indefinitely rather than delivered as a single blow.

• Sustained denial of service: A device can be kept off its network for as long as the attacker keeps transmitting, which is what we demonstrate later in this article. Put simply: this is not a glitch that passes, it lasts exactly as long as they want it to.
• No pairing, no password, no proximity to the access point: The attacker needs only to be within radio range of the victim. What that means: they do not need to be on the network, know anything about it, or be anywhere near the router. Sitting in the same cabin is enough.

The list doesn’t end here. We will go over some important techniques and their impact on aviation more carefully, starting with arguably the most important one: the pilots’ Electronic Flight Bag.

Attack 1 – The Pilots’ Tablet Is Reachable

What is an EFB?

An EFB, open on the pre-flight briefing for a scheduled service.

The acronym may sound more like a government agency than aviation tech, but it simply means Electronic Flight Bag, the same one conceptually that used to be an old physical 18kg bag that the pilots used to carry around, containing paper manuals, charts, and flight logs that help the pilots plan their routes and the aircraft’s checklist. These days it has been replaced with an electronic tablet, in most cases an ordinary iPad, which hosts plenty of different apps the pilots use constantly.

Some flight-critical uses, for example:

1. Terminal Charts & Enroute Navigation (Situational Awareness)
The EFB overlays the “own-ship” position (the aircraft’s real-time GPS coordinates) directly onto airport taxi diagrams and instrument approach plates. This feature drastically reduces the risk of runway incursions at complex airports and ensures precise adherence to instrument flight rules (IFR) paths.

2. Performance Calculations & Weight and Balance
Miscalculating V-speeds, takeoff thrust, or required stopping distances can result in a runway overrun. EFB apps calculate these complex aerodynamic variables in seconds, accommodating mid-flight updates if Air Traffic Control (ATC) suddenly changes the active runway.

3. In-Flight Hazard Awareness (Weather, Terrain, Traffic)
Pilots can view live NEXRAD radar, iced-airspace warnings (SIGMETs/AIRMETs), terrain proximity alerts (Synthetic Vision), and nearby aircraft traffic. This gives the flight crew early notice to request route diversions around severe convective weather.

All of this very critical data reaches the EFB tablet and the pilots, over ordinary Wi-Fi.

Not every one of those applications needs a live link at every moment. Plenty of operators synchronise before departure and cache the charts and the manuals on the device, so what a lost connection actually costs depends on the phase of flight, the application in use, and how the operator has built its EFB architecture. That narrows the window rather than closing it. A tablet that pulls its briefing on the ground still has to be on a network on the ground, at the gate or in the crew room, which is precisely where somebody with a phone in their pocket can stand next to it.

Whichever network the EFB is attached to, the Nexus 5 running NexMon, can reach as well.

That very same deauthentication attack that the phone can execute against a laptop can be done on that very same EFB the pilots are using. Since Wi-Fi is a standard protocol mostly running on the 2.4 GHz or 5 GHz bands, the Nexus smartphone can reach the tablet easily, and a single forged frame is enough to put it off the air for as long as the attacker keeps sending them.

We ran this against a real one. The tablet below is an airline-issued EFB, in the hands of a line pilot, loaded with the briefing for an actual scheduled flight. The phone beside it is the same Nexus 5 from earlier in this article, and the EFB was on our own network: what these photographs show is the flight bag itself being taken off the air, wherever it happens to be connected.

The EFB and the phone that is about to take it off the air. The phone has already found the network the tablet is using, listed at the top of its screen.

The attack itself, one tap on Disconnect. The panel above shows the target network is WPA2 protected. That makes no difference here, because the frame carrying the disconnection is not covered by the encryption.

Seconds later. The tablet has lost its connection, and keeps showing the crew stale information until the link returns.

The consequence, in the EFB’s own words: the update it was retrieving has failed. This is not a tablet that has merely lost Wi-Fi; it is a briefing that did not arrive.

Pushing the EFB off its network is where this starts, not where it ends. The same phone can put up a network of its own, and a device that has just lost its connection reaches for whatever looks familiar. Once it joins, the attacker is sitting between the tablet and everything it trusts, and from that point everything the crew reads has passed through somebody else’s hands.

The crew will notice a briefing that never arrives, but they have no way of noticing one that arrives and is wrong, and that isn’t hypothetical.

Consider the case of NAVBLUE Flysmart+, an EFB app that is used by pilots worldwide and was found to be vulnerable by the cybersecurity firm Pen Test Partners, allowing an attacker to possibly tamper with the data inside the app remotely, and, for one example, interfere with the engine performance calculations, potentially resulting in a tail-strike or runway excursion on departure.

And what reaches an EFB can reach every other computer on board that a passenger can sit next to. But interfering with the pilots’ tech isn’t the only problem we are facing these days. The next risk we’ll present is about the everyday passengers, who are forced to share a cabin space, a Wi-Fi hotspot, and the same network as the attackers.

Attack 2 – Taking Over the Cabin’s Network

You might have asked yourself throughout the article, “how does it makes sense that such a small and mundane device can cause actual damage and disconnect other devices from the network so easily?” This is happening due to the way Wi-Fi was built historically.

Monitor mode on the phone’s internal chip: 24 access points and 4 client devices seen passively in a single sweep, each with its signal strength, channel and encryption. Photo: CYVIATION lab.

The original 802.11 Wi-Fi standard left something called “the management frames” (which include deauthentication packets) to be completely unauthenticated, meaning anyone could forge a deauthentication frame claiming to be legit and therefore disconnect a device from the network. This hole was closed with the newer standard 802.11w, when they added protected management frames. It uses a key that is already established during the handshake to cryptographically protect deauthentication frames, so spoofed ones get rejected immediately. The catch is that the protected management frames are optional under WPA2, so lots of networks never turn it on. It is only mandatory in WPA3, meaning a properly configured WPA3 network is genuinely protected against the classic spoofed deauthentication attack.

The attack menu on our own test network. Once an access point and one of its clients are selected, continuous deauthentication is a single keystroke away. Photo: CYVIATION lab.

That covers one attack vector. There is a second and cruder one: flooding the channel with raw noise. No amount of frame protection helps against it, because it happens at the physical layer, where protected management frames are irrelevant.

A software defined radio on the CYVIATION bench.

The equipment that does it is a software defined radio, and it’s neither exotic nor expensive. It cost less than a mid-range phone, and it fits in a jacket pocket. Against raw noise on the channel a WPA3 network fails in exactly the same way a WPA2 one does, because by that point the argument has dropped below the level where any encryption exists at all.

This brings us to the cabin itself. In a full commercial flight, which can sometimes include over 500 passengers, the Wi-Fi band is extremely crowded. 500 people with their phones, tablets, smartwatches, headphones, laptops, and other electronics can very easily fit thousands of Wi-Fi-enabled devices in the cabin.

This ocean of electronics is the perfect target, and the attacker does not need a list of victims. A deauthentication frame can be addressed to everyone on the network at once, so from a single cheap phone an entire cabin can be pushed off the Wi-Fi and held there.

But our attacker doesn’t stop here. Disrupting the Wi-Fi is one thing, but a seasoned adversary has another incentive in mind:

Getting paid.

By using a combination of simple techniques, an attacker can very easily trick users into logging into a malicious hotspot and steal their credentials, credit card information, and personal data, all done from an ordinary smartphone.

The sign-in page shown later in this section is one we wrote ourselves, and it asks only for a name. That was a deliberate choice for a demonstration. The same page is where an attacker would ask for an email address and a password, or present it as the airline’s paid Wi-Fi portal and ask for card details, and the passenger has no way to tell the difference.

The same phone’s home screen: the NetHunter suite alongside the Evil Twin console built for this research. Photo: CYVIATION lab.

We start with a deauthentication attack to push the victim off the network, then fill the air with access points of our own. We use the flood to bury the real network in a list of plausible alternatives for anyone choosing by hand. Then, once a passenger is connected, all of their traffic runs through the attacker’s device. This is a typical Adversary-in-the-Middle attack, or Evil Twin.

Every stage below was built on the phone described above and run against our own devices on a lab network.

The target device’s network list before the attack. Two known networks and one neighboring access point.

The same list seconds later, during the flood. Every one of these networks is a beacon frame sent by the phone in the reader’s pocket, and the list continues past the bottom of the screen. Cabin names were chosen for the demonstration; an attacker would copy the name the airline actually uses.

The portal as the victim sees it. We wrote this page ourselves, and it asks only for a name; the same form is where an attacker would ask for card details or account credentials. The address bar reads captive.apple.com, the address iOS itself checks for a sign-in page, while the page being served comes from the phone.

Once a name is submitted the device is released onto the network, and every request it makes from that point is attributed to that name.

The operator’s view, running on the phone itself: each site the connected device reaches, as it reaches it.

One device over a few minutes: 37 distinct domains across 765 events. The domains alone identify it as an iPhone signed in to Apple and Google accounts.

This attack is so dangerous for two reasons:

• The victim can be directed to a fake login page, allowing the attacker to capture their credentials, or a fake payment portal webpage pretending to be the airline’s internet purchase function, mid-flight.
• This attack isn’t too difficult to perform, and almost unnoticeable to the untrained eye. If orchestrated carefully, the attack can span just a few minutes, granting the attacker a huge financial gain and letting them vanish entirely unnoticed, all done from a single smartphone.

Nothing about this is limited to passengers. We repeated it against the airline EFB. We knocked it off its network, it joined ours, and from that point the phone saw everything it tried to reach and the operational site it needed no longer loaded.

The flight bag, now on the attacker’s network. The console beneath it is already logging where the tablet goes.

The operational site the crew depends on, failing to load, while every request the tablet makes is recorded on the phone.

This attack opens up an actual financial risk for the airline, not only by legal responsibility, but also by the loss of reputation, or even possibly fined by the local air authority as well.

Some adversaries will rest assured after performing a successful attack on said scale, bringing in hundreds of thousands of dollars, or even more, in profit. But some adversaries have other incentives in mind. Some can be state-sponsored attackers who are interested mainly in causing harm, or even psychological damage. This brings us to the last stage.

Attack 3 – Audio in the Cockpit

Passengers increasingly bring their own entertainment aboard. In SITA’s Passenger IT Trends Survey, 65% of passengers said they would like to access in-flight entertainment on their own devices, and airlines have built around that expectation ever since.

The scale is what makes it matter. IATA expects 5.2 billion passengers to fly in 2026, close to fourteen million people every day. Wireless is now the default rather than the exception; most headphones sold today have no cable at all. Take a deliberately conservative reading of that – only half the cabin using headphones, and only two thirds of those wireless – and it still puts roughly five million people a day in the air with a Bluetooth headset on their head. The real figure is likely higher.

That is the reason for what follows: a vulnerability named CVE-2025-36911, or, if you’d prefer the more endearing nickname, WhisperPair.

The vulnerability was found by researchers at KU Leuven. It exploits a flaw in Google’s Fast Pair, the feature that lets headphones pair with a tap, and which ships by default across a wide range of consumer audio devices. An accessory that is not in pairing mode is supposed to ignore a pairing request. Many do not, and an attacker can use that to force headphones or earbuds to bond with a device of their own, without the owner’s consent or knowledge.

From there the attacker holds the accessory: they can play audio through it, record through its microphone, and follow its location. It takes seconds, needs no physical access, and the tooling is a free download.

We tested this ourselves, against our own headphones: a Sony WH-1000XM5 running firmware 2.4.1.

The target headphones in normal use, connected to their owner’s phone.

The same headphones as the attacker sees them: no name, and marked Idle. Not being in pairing mode is precisely the state in which Fast Pair requires an accessory to ignore pairing requests.

Bonded to the attacker’s device. The address shown is the headphones’ real Bluetooth address, which they disclose during the exchange despite advertising a rotating random one.

Android then offers to save the hijacked headphones to the attacker’s own Google account. Binding an accessory this way is what allows its location to be followed through Find Hub.

The researchers’ own testing found affected models from Sony, Google, JBL, Jabra, Anker, Nothing, Marshall, Xiaomi and OnePlus. Notably, several other devices they tested were not affected, so this is a flaw in how individual accessories implement Fast Pair rather than a blanket failure of every wireless headphone.

For a passenger, this is a privacy breach and a genuine discomfort. The sharper question is what happens when the same class of consumer device is on the flight deck rather than in seat 14A.

What the Pilots Are Wearing

Pilots are using headphones as well during their flights. It’s not a kept secret at all. It is their way to communicate with the ATC, to receive and transmit instructions and other flight-critical information. The headphones they are using are actually wired in, like the Sennheiser HMEC 26. However, we are more worried about the pilot headphones that have Bluetooth connectivity in addition to that. No aviation headset appears anywhere in the researchers’ affected-device list, but the exposure is not the certified headset. It is the consumer earbuds and headphones crews carry from home, which is exactly the class of device we tested, and which policy is already supposed to keep out of the flight deck.

There is regulation covering what may be worn on the flight deck, but regulation and practice are not the same thing. From our work with airline operators, this is a gap we run into regularly. Crews bring their own equipment on board, personal headsets turn up on flight decks, and whether any of it is approved for the role is not something anybody is checking. A rule that nobody enforces protects nobody.

An accessory an attacker has bonded to can play audio into the wearer’s ears, listen through its microphone, and report where it is. None of that changes based on who is wearing it or which seat they are sitting in. Which is why the question of what crews carry aboard, and whether anybody checks, is worth asking now rather than after an occurrence.

The vulnerability itself can be patched via a firmware update. The problem is that most people never bother to install it, and almost none even know about the existence of this vulnerability. Not to mention, it is very easy to replicate and requires little to no effort at all. Some developers even customized it into an actual application that is freely available to download. With a single click, you can breach the headphones around you, from your own phone, mid-flight, without leaving a trace.

What Would Have Stopped Us

Everything in this article has a fix, and none of the fixes are clever. That’s the part that should bother people.

The deauthentication attack, the one we ran against the EFB and then against a whole cabin at once, stops working the moment protected management frames are switched on. That protection has been sitting in the Wi-Fi standard since 2009. It’s optional under WPA2, which is why hardly anybody turned it on, and mandatory under WPA3, which is why a properly configured WPA3 network simply refuses the frames we were sending.

WhisperPair closes with a firmware update on the headphones themselves. The catch is that headphones aren’t something people update, and most owners have no idea there is anything to update.

The rest is operational, and operational is what airlines are good at. Crews cross-check their numbers between two flight bags. Backup devices exist, paper procedures exist where the operator still carries them, and there are rules about what may be worn on the flight deck. All of it works, right up until nobody checks whether any of it is actually happening.

None of this is new, none of it is expensive, and none of it is difficult. It just isn’t being done.

From Cybersecurity to Security

In this article we managed to show how a single, cheap, ordinary smartphone can become an actual weapon, a real safety risk to both the passengers and flight crew, and a massive financial risk to the airline itself. No special tools are required anymore, not even a highly technical person. The only requirement is someone with the right mindset and an incentive, which could be ideological, political, or financial.

There used to be a time when terrorists had to use a physical weapon, like a bomb, to cause damage, but today a simple phone could cause the same kinetic damage using cyber means. In this article we chose to focus on the Nexus 5, but nothing about these attacks is particular to it. Kali NetHunter, the platform we used, is an operating system built for security professionals that runs on a range of ordinary consumer devices. The barrier to entry is knowledge, not hardware. There are other ways to use these attacks in addition to that, but the way itself doesn’t matter as much as the result, and the point that each and every one of them gets past airport security without raising suspicion.

In a world where a badminton racquet is banned from entering the cabin to prevent a person from hurting anyone, while a device capable of potentially crashing the aircraft is not even suspected, we have to start taking action and shift the mindset from cybersecurity to simply security when it comes to aviation.

There is a practical version of that shift, Cyber hazards belong in the same Safety Management System that already carries every other risk an operator runs, which means they get identified as hazards, assessed for risk, put through management of change when the fleet or the cabin fit changes, and reported when something happens. EASA Part-IS points in that direction. The difference it makes is whether a hijacked headset or a rogue access point in a cabin is logged as a safety occurrence or dismissed as an IT ticket.

That shift is the work we do at CYVIATION. We study the aircraft’s wireless attack surface the way an attacker would, from the earbuds the pilot is wearing to the tablets on the flight deck, so these weaknesses are found by people who will disclose them, not exploit them. Because most of these gaps cannot be patched out of a cabin overnight, we build the monitoring that lets an airline watch its own airwaves and catch a cabin turning hostile while the flight is still in the air, and we give manufacturers and regulators the evidence to close the underlying holes for good. The attack tool already clears security in every pocket on board. Our part is making sure it no longer does so unseen.