The Boeing company has released a worldwide safety alert for their Onboard Performance Tool (OPT) for iOS following a vulnerability discovery from British security firm Pen Test Partners. Boeing’s OPT allows flight crew and ground personnel to “perform real-time weight and balance and takeoff and landing calculations for all current Boeing airframes” and is available on iOS and Windows, as well as EFB versions for integrated devices onboard aircrafts. The researchers identified an issue with the calculations the tool made in the iOS version of the app, allowing threat actors to tamper with mission-critical data and causing pilots to use the wrong settings and potentially inducing a crash. While this vulnerability has a “low risk of interference,” it was patched by Boeing last year. Further testing of the application led the researchers to discover another flaw in the application. The second vulnerability existed in a vital database used by the OPT, which was not secured against unauthorized changed. The database stored records of the length of runways at various airports. By changing the records in this database, threat actors could have increased the risk of a crash at takeoff or landing without any warnings that the modification had occurred. After two (2) years of working with Boeing, Pen Test Partners has confirmed that this issue has been fixed in July 2022. The long delays between discovery and patching are due to the number of regulatory approvals required to make the change to the OPT application. This example highlights the slow response times that have plagued the aviation industry for years. CTIX analysts recommend organizations utilizing Boeing’s Onboard Performance Tool to ensure the tool is updated to the latest version OPT v4.72.