IEC 60870-5-104 Security: From APCI State Activation to IEC 62351

Description and use

The study revealed that IEC 60870‑5‑104 lacks authentication during link activation, enabling attackers to send commands once the link is active. The implementation allows direct command execution and tolerates out‑of‑sequence counters, highlighting the need for transport‑layer security or IEC 62351 extensions.

Problem

IEC 60870-5-104 lacks authentication at link activation, allowing attackers to reach control functions if they know addressing scheme.

Outcome

The study revealed that IEC 60870‑5‑104 link activation is unauthenticated, allowing attackers to send commands once the link is active. The implementation tolerated out‑of‑sequence counters and did not enforce Select‑Before‑Operate, enabling direct control execution. These findings highlight the necessity of adding transport‑layer security or IEC 62351 extensions.

Workflow

• Set up isolated lab with lib60870-C cs104_server_no_threads on 127.0.0.1:2404
• Establish TCP connection and send raw U‑format STARTDT ACT frame
• Capture traffic with Wireshark to observe link activation sequence
• Send I‑frames after activation to test command execution and sequence handling
• Inject malformed or out‑of‑sequence frames to test parser boundary and error handling
• Compare cleartext behavior with TLS/mTLS lab to assess security boundary

Evidence

There was no identity negotiation, credential exchange, cryptographic challenge, or authentication step between TCP establishment and link activation.

Source

The command was accepted without a preceding Select operation.

Source