IEC 61850 Security Research: From SCL and MMS to GOOSE, Sampled Values, and the Process Bus

说明与用途

研究表明 IEC 61850 的配置和控制操作缺乏身份验证，GOOSE/Sampled Values 可通过操纵状态和序列字段被攻击者利用，暴露关键安全漏洞。

问题

Industrial control systems using IEC 61850 expose configuration and operational data over multiple protocols (SCL, MMS, GOOSE, Sampled Values) that lack robust authentication and authorization, creating a risk of unauthorized discovery and manipulation of control points.

结果

The study demonstrates that IEC 61850’s configuration and control layers are exposed to discovery and manipulation without proper auth, and that GOOSE/SV traffic can be subverted by manipulating state and sequencing fields, highlighting critical gaps in industrial protocol security.

工作流

• 1. Set up isolated lab with libIEC61850 and virtual Ethernet bridge.
• 2. Extract and analyze SCL configuration to map IED capabilities.
• 3. Enumerate MMS data model using a custom Python harness.
• 4. Test control operations via MMS, observing lack of auth enforcement.
• 5. Capture GOOSE and Sampled Values frames on the process bus.
• 6. Manipulate GOOSE fields (stNum, sqNum, TAL) and SV frequency to inject anomalies.
• 7. Observe subscriber reactions to crafted traffic.

证据

The laboratory demonstrated that a properly constructed control operation could alter the simulated control state without an authentication mechanism being enforced by the tested configuration.

来源

GOOSE frames contain state and sequencing information that allows subscribers to reason about publisher behavior.

来源