IEC 60870-5-104 — IEC 60870-5-104

IEC 60870-5-104 (IEC-104 for short) is a telecontrol protocol widespread in European energy supply, via which control centres communicate with substations and stations. It transmits measurements and switching commands over TCP/IP networks. It became known as the attack route of the Industroyer malware.

History & facts. IEC-104 brings the telecontrol technology of energy supply onto TCP/IP and thereby enables the network-based monitoring and control of widely distributed stations. Like many OT protocols, it was designed without strong authentication and encryption — the focus was on reliability and real time, not on repelling attackers. This very property was used by Industroyer and Industroyer2 to issue switching commands to substations. Outlook & recommendation. Since subsequent encryption is often not possible in existing facilities, segmentation, strict control of remote access and above all the monitoring of IEC-104 communication are decisive: anomalous or unexpected switching commands can be detected when the traffic is observed. For KRITIS operators in the energy sector, this protocol and its threat potential are part of the essential knowledge.

Related terms