IEC 61850 Security Research: From SCL and MMS to GOOSE, Sampled Values, and the Process Bus

Описание и применение

Исследование выявило, что конфигурация и контрольные операции в IEC 61850 доступны без аутентификации, а протоколы GOOSE и Sampled Values позволяют злоумышленнику подделывать состояние и последовательность сообщений, что приводит к нарушению безопасности промышленной сети.

Задача

Industrial control systems using IEC 61850 expose configuration and operational data over multiple protocols (SCL, MMS, GOOSE, Sampled Values) that lack robust authentication and authorization, creating a risk of unauthorized discovery and manipulation of control points.

Результат

The study demonstrates that IEC 61850’s configuration and control layers are exposed to discovery and manipulation without proper auth, and that GOOSE/SV traffic can be subverted by manipulating state and sequencing fields, highlighting critical gaps in industrial protocol security.

Рабочий процесс

• 1. Set up isolated lab with libIEC61850 and virtual Ethernet bridge.
• 2. Extract and analyze SCL configuration to map IED capabilities.
• 3. Enumerate MMS data model using a custom Python harness.
• 4. Test control operations via MMS, observing lack of auth enforcement.
• 5. Capture GOOSE and Sampled Values frames on the process bus.
• 6. Manipulate GOOSE fields (stNum, sqNum, TAL) and SV frequency to inject anomalies.
• 7. Observe subscriber reactions to crafted traffic.

Доказательства

The laboratory demonstrated that a properly constructed control operation could alter the simulated control state without an authentication mechanism being enforced by the tested configuration.

Источник

GOOSE frames contain state and sequencing information that allows subscribers to reason about publisher behavior.

Источник