IEC 61850 Security: GOOSE Spoofing & Substation Attacks

IEC 61850 is the international standard for substation automation and protection. It defines three key communication services: MMS (Manufacturing Message Specification) over TCP/IP for SCADA data exchange, GOOSE (Generic Object Oriented Substation Event) for fast protection signalling over Ethernet multicast, and Sampled Values (SV) for continuous digitised current/voltage streams.

GOOSE operates at Layer 2 (EtherType 0x88B8), bypassing TCP/IP entirely. It delivers protection signals — like "trip circuit breaker" — in under 4 milliseconds. In IEC 61850 Edition 1 and Edition 2, GOOSE carries no authentication.

GOOSE Spoofing Attack

Any device with Layer 2 access to the process bus can publish a GOOSE frame claiming to be a legitimate protection relay. A spoofed frame with a higher state number (stNum) than the legitimate publisher's current value forces all subscribed IEDs to accept the new state immediately — including "trip" signals that open circuit breakers.

The 2016 Industroyer/Crashoverride malware targeting the Kiev power grid included a dedicated IEC 61850 module implementing exactly this technique.

MMS Security

MMS (port 102/TCP via ISO transport) is used by SCADA servers for data polling and configuration. Base MMS has no authentication — access to the station bus network allows any host to query and modify IED configuration, read measurements, and issue control commands via MMS OPERATE services.

IEC 62351-6: The Fix for GOOSE

IEC 62351 Part 6 (2020) adds HMAC-SHA-256 message authentication to GOOSE and Sampled Values frames. Each frame includes an 8-byte MAC and a key identifier. IEDs without the current group key reject frames. The Group Controller Key Server (GCKS) distributes multicast keys to authorised IEDs.

Defences