IEC 61850 GOOSE Spoofing: How Attackers Trip Circuit Breakers

A GOOSE message trips a circuit breaker in under 4 milliseconds. That timing is not a bug — it is the entire point. IEC 61850 Generic Object Oriented Substation Events (GOOSE) exist precisely because protection relays need to respond to faults faster than any polling-based protocol can manage. When a short circuit appears on a 138 kV bus, 4ms is the difference between a contained fault and a cascading grid failure.

The same speed that makes GOOSE essential to power system protection makes GOOSE spoofing uniquely dangerous. In IEC 61850 Edition 1 and Edition 2 — the editions deployed in the vast majority of operational substations — GOOSE messages carry no authentication. Any device on the substation process bus LAN can publish a GOOSE message claiming to be any Intelligent Electronic Device (IED), and every subscribed IED will act on it immediately.

What GOOSE Is and Why It Matters

IEC 61850 defines three main communication services:

• MMS (Manufacturing Message Specification) — TCP/IP-based, used for SCADA polling, configuration, and event reporting. Relatively slow (seconds).
• GOOSE (Generic Object Oriented Substation Event) — Ethernet multicast, bypasses TCP/IP stack entirely. Used for protection signalling and interlocking. Target delivery: <4ms.
• Sampled Values (SV) — Continuous stream of digitised current and voltage samples for differential protection. Very high throughput, microsecond timing.

GOOSE operates at Layer 2 (Ethernet) using EtherType 0x88B8. It does not use IP addresses, UDP, or TCP. Messages are sent as multicast frames to a destination MAC address configured in the IED's GOOSE control block (GoCB). Subscribed IEDs listen for multicast frames matching their configured AppID and GOOSE control block reference.

The typical GOOSE use case is protection relay interlocking: when Relay A detects an overcurrent condition, it publishes a GOOSE "trip" signal; Breaker B receives the multicast, sees the trip bit set, and opens within 4ms. This is faster than any human operator, faster than any SCADA poll, and faster than any TCP connection setup.

The Authentication Gap in Edition 1 and 2

The IEC 61850 standard was first published in 2003–2005 (Edition 1) and revised in 2007–2010 (Edition 2). Neither edition included authentication for GOOSE or Sampled Values. The security assumption was that the process bus — the dedicated Layer 2 network connecting relays and merging units in a substation — was physically secured and isolated from external networks.

This assumption has eroded significantly:

• Modern substations connect process bus to station bus (where SCADA and engineering workstations operate) through managed Ethernet switches
• Remote access VPNs for maintenance engineers create pathways from corporate networks into the station bus
• Advanced metering infrastructure (AMI) networks in adjacent buildings sometimes share Layer 2 segments with substation equipment
• Supply chain compromises can introduce malicious firmware into IEDs during manufacturing or maintenance

How a GOOSE Spoofing Attack Works

Step 1: Reconnaissance

Capture GOOSE traffic passively using a Linux host with a promiscuous mode network interface. Wireshark dissects GOOSE with goose display filter. Key fields to extract:

# Wireshark GOOSE fields of interest:
goose.gocbRef      # Control block reference — identifies the publisher IED
goose.appId        # Application ID — must match in spoofed frame
goose.stNum        # State number — increments on value change
goose.sqNum        # Sequence number — increments on every retransmission
goose.allData      # The actual data set — boolean, integer, float values

A legitimate GOOSE publisher retransmits the same message at increasing intervals (T1 fast retransmit, then T2, T3, T4 slow steady state). By observing the retransmission pattern, an attacker can identify the normal state values and timing.

Step 2: Craft the Spoofed Frame

The spoofed GOOSE frame must use the exact AppID, gocbRef, and datSet from the legitimate publisher, but with:

• stNum set to legitimate_stNum + 1 — a higher state number forces subscribed IEDs to accept the new value as a state change
• sqNum reset to 0 — consistent with a new state transition
• The trip bit (or target boolean) set to TRUE
• Source MAC spoofed to match the legitimate publisher IED's MAC address

# Conceptual GOOSE spoof (Scapy-style pseudocode)
frame = Ether(
  src="aa:bb:cc:dd:ee:ff",   # publisher IED MAC
  dst="01:0c:cd:01:00:01",   # GOOSE multicast group
  type=0x88B8              # GOOSE EtherType
) / GOOSE(
  appId=0x0001,
  gocbRef="REL_A/LLN0$GO$GoCB01",
  stNum=observed_stNum + 1,  # ← higher stNum forces acceptance
  sqNum=0,
  allData=[True]             # ← trip signal asserted
)
sendp(frame, iface="eth0")

Step 3: Immediate Physical Effect

A subscribed protection relay or breaker controller receiving this frame with a higher stNum treats it as a legitimate state change from the publisher IED. Per the IEC 61850 standard, it must act on new state data immediately — there is no mechanism to verify authenticity. The circuit breaker opens within <4ms.

Depending on which GOOSE control block is spoofed, the effect could be:

• Unwanted tripping — opening a breaker that should be closed, de-energising a bus section or feeder
• Blocking protection — asserting a "block trip" signal that prevents legitimate protection operations, leaving a fault uncleared
• False interlocking — preventing maintenance switching operations by asserting busy or interlock signals

The 2015–2016 Ukraine Grid Attacks

The Industroyer/Crashoverride malware used in the December 2016 Kiev attack (causing a 1-hour blackout) included a dedicated IEC 61850 module. While the primary attack vector used IEC 104 to send direct commands to RTUs, the IEC 61850 component demonstrated the ability to publish GOOSE messages directly to protection relays — precisely the GOOSE spoofing scenario described here. The malware authors had clearly studied the substation protocol in detail and understood that unauthenticated GOOSE was a viable attack path.

IEC 62351-6: The Fix

IEC 62351 Part 6 (published 2020, revised 2023) defines security for IEC 61850 GOOSE and Sampled Values using a HMAC-based Message Authentication Code prepended to each frame.

The GCKS distributes multicast group keys to all IEDs in the same GOOSE multicast group. An IED that receives a GOOSE frame with an invalid or missing MAC rejects it. A spoofed frame from an attacker without the current group key will fail MAC verification and be silently discarded.

Why Adoption Is Still Limited

Like DNP3 SA, IEC 62351-6 faces significant deployment barriers:

• IED firmware — Most operational IEDs (GE, Siemens, ABB, SEL) support IEC 62351-6 only in hardware released after ~2018. Earlier generations require replacement.
• GCKS infrastructure — A key server must be deployed and integrated with the substation's network. This is a new operational responsibility for protection engineers who have traditionally never managed PKI or key distribution.
• Testing complexity — Commissioning and FAT (Factory Acceptance Testing) for authenticated GOOSE is significantly more involved than base GOOSE testing.
• No mandate — NERC CIP does not currently mandate IEC 62351-6 for substation protection systems, though IEC TS 62351-90-1 (security guidelines) strongly recommends it.

Compensating Controls While Waiting for IEC 62351-6

For substations that cannot immediately deploy authenticated GOOSE, the practical defence is strict Layer 2 segmentation:

• Separate process bus VLANs — Process bus (GOOSE, SV) on a dedicated VLAN, physically or logically separate from station bus (MMS, SCADA). Managed switches enforce this.
• MAC address allow-listing — Configure the process bus switch to only forward GOOSE multicast frames from known IED MAC addresses. Unknown source MACs are dropped.
• No station bus–process bus bridging — Engineering workstations and SCADA servers must not have Layer 2 connectivity to the process bus. A Layer 3 boundary (firewall or router) between station bus and process bus prevents GOOSE from crossing the boundary (GOOSE is Layer 2 only; it does not route).
• Process bus IDS — Passive monitoring for unexpected GOOSE publishers (new AppIDs, unexpected stNum jumps, GOOSE from unlisted MAC addresses).

Summary

• GOOSE is a Layer 2 Ethernet multicast protocol designed for <4ms protection signalling
• IEC 61850 Edition 1 and 2 have no GOOSE authentication — any Layer 2 peer can spoof a trip signal
• A spoofed GOOSE with a higher stNum is accepted and acted on immediately by subscribed IEDs
• Industroyer/Crashoverride (2016) demonstrated real-world GOOSE attack capability
• IEC 62351-6 (HMAC-SHA-256) fixes this but requires hardware support and a GCKS
• Short-term mitigation: strict Layer 2 segmentation and MAC address allow-listing on process bus switches