IEC 60870-5-104 Security: From APCI State Activation to IEC 62351

说明与用途

研究表明 IEC 60870‑5‑104 在链路激活时缺乏身份验证，攻击者只要知道地址即可发送命令。实现允许直接执行命令并容忍序列号跳跃，需加强安全措施。

问题

IEC 60870-5-104 lacks authentication at link activation, allowing attackers to reach control functions if they know addressing scheme.

结果

The study revealed that IEC 60870‑5‑104 link activation is unauthenticated, allowing attackers to send commands once the link is active. The implementation tolerated out‑of‑sequence counters and did not enforce Select‑Before‑Operate, enabling direct control execution. These findings highlight the necessity of adding transport‑layer security or IEC 62351 extensions.

工作流

• Set up isolated lab with lib60870-C cs104_server_no_threads on 127.0.0.1:2404
• Establish TCP connection and send raw U‑format STARTDT ACT frame
• Capture traffic with Wireshark to observe link activation sequence
• Send I‑frames after activation to test command execution and sequence handling
• Inject malformed or out‑of‑sequence frames to test parser boundary and error handling
• Compare cleartext behavior with TLS/mTLS lab to assess security boundary

证据

There was no identity negotiation, credential exchange, cryptographic challenge, or authentication step between TCP establishment and link activation.

来源

The command was accepted without a preceding Select operation.

来源