IEC 104 (IEC 60870-5-104) Security
IEC 60870-5-104 (commonly "IEC 104") is the TCP/IP adaptation of IEC 60870-5-101 — the serial telecontrol standard for power grid SCADA. It transports monitoring and control data between SCADA master stations and RTUs/substation gateways over TCP port 2404. IEC 104 is the primary SCADA protocol for European and Asian power utilities and was one of the two protocols targeted in the 2016 Ukraine power grid attack by Industroyer/Crashoverride malware.
Protocol Structure
IEC 104 uses an Application Protocol Control Information (APCI) wrapper over TCP. The payload (ASDU — Application Service Data Unit) carries information objects: single-point status, double-point status, measured values, integrated totals, and command objects. The command types directly control field equipment:
| Type ID | Name | Effect |
|---|---|---|
| 45 (0x2D) | Single Command | Toggle single-bit output (e.g., breaker open/close) |
| 46 (0x2E) | Double Command | Two-bit position command (e.g., valve open/close with confirmation) |
| 47 (0x2F) | Regulating Step Command | Tap changer raise/lower |
| 48–51 | Set Point Commands | Normalised, scaled, short float, 32-bit integer setpoints |
The Industroyer/Crashoverride IEC 104 module sent Type ID 45 (Single Command) ASDU frames directly to substation RTUs to open circuit breakers, bypassing the SCADA master entirely.
Security Vulnerabilities
- No authentication — any TCP host reaching port 2404 can send command ASDUs
- No encryption — all measurement data and command parameters in cleartext
- Select-Before-Operate (SBO) bypassable — IEC 104 SBO is a process control feature (confirmation step), not a security mechanism; an attacker can bypass by sending Direct Execute commands
- Sequence number weakness — predictable send/receive sequence numbers enable session hijacking
IEC 62351-5: Adding TLS
IEC 62351 Part 5 defines TLS encapsulation for IEC 104 (and DNP3). The SCADA master and RTU establish a mutual TLS session using X.509 certificates before the IEC 104 APCI connection. This provides authentication (both endpoints verify each other) and encryption. Adoption is growing but limited by legacy RTU hardware constraints.
Defences
| Control | SR | Effect |
|---|---|---|
| IEC 62351-5 TLS | SR 3.1, SR 4.1 | Mutual auth + encryption for all IEC 104 sessions |
| Firewall port 2404 | SR 5.2 | Allow only SCADA master IP to reach RTU port 2404 |
| OT IDS for Type ID 45–51 | SR 6.2 | Alert on command ASDUs from non-SCADA sources |
| Network segmentation | SR 5.1 | RTU communication network isolated from IT |
Examine IEC 104 ASDU structure, the Industroyer attack methodology, and IEC 62351-5 TLS implementation in the interactive protocol lab.
Open IEC 104 Protocol Lab →