IEC 61850 Security Research: From SCL and MMS to GOOSE, Sampled Values, and the Process Bus

Description and use

The study shows that IEC 61850 configuration and control operations are exposed without authentication, and that GOOSE/Sampled Values can be subverted by manipulating state and sequence fields, exposing critical security gaps.

Problem

Industrial control systems using IEC 61850 expose configuration and operational data over multiple protocols (SCL, MMS, GOOSE, Sampled Values) that lack robust authentication and authorization, creating a risk of unauthorized discovery and manipulation of control points.

Outcome

The study demonstrates that IEC 61850’s configuration and control layers are exposed to discovery and manipulation without proper auth, and that GOOSE/SV traffic can be subverted by manipulating state and sequencing fields, highlighting critical gaps in industrial protocol security.

Workflow

• 1. Set up isolated lab with libIEC61850 and virtual Ethernet bridge.
• 2. Extract and analyze SCL configuration to map IED capabilities.
• 3. Enumerate MMS data model using a custom Python harness.
• 4. Test control operations via MMS, observing lack of auth enforcement.
• 5. Capture GOOSE and Sampled Values frames on the process bus.
• 6. Manipulate GOOSE fields (stNum, sqNum, TAL) and SV frequency to inject anomalies.
• 7. Observe subscriber reactions to crafted traffic.

Evidence

The laboratory demonstrated that a properly constructed control operation could alter the simulated control state without an authentication mechanism being enforced by the tested configuration.

Source

GOOSE frames contain state and sequencing information that allows subscribers to reason about publisher behavior.

Source