IEC60870-5-104 Protocol Security Analysis and Automated Simulation Attack System

IEC60870-5-104 (IEC 104 for short) protocol is widely used in the electric power industry, for communication between the master station and the sub-station. IEC 104 protocol itself lacks effective identity authentication and access control. In the case of network reachable, through the protocol we can control the remote equipment in the distance, and obtain the control of the entire power station. At the same time, the protocol involves many assets of the electric power monitoring systems, and once the vulnerability is used, the loss caused by it is incalculable. This paper designs and develops a device that supports IEC 104 protocol in an automated discovery system, quickly and comprehensively evaluates the attack scopes of IEC 104 protocol, and simulates attacks on it to realize controllable protocol vulnerability verification. The system focuses on the equipment that does not adopt the default configuration of the IEC 104 protocol, and automatically carries out the blasting of public addresses, Tele-Controlling methods and Tele-Controlling addresses, and can efficiently check the equipment that is not in the default configuration. The practical test results also verify the practicality and effectiveness of this tool.