Exploiting the GOOSE protocol: A practical attack on cyber-infrastructure

Hoyos, Juan; Dehus, Mark; Brown, Timthy X

doi:10.1109/glocomw.2012.6477809

Cited by 103 publications

(64 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…While vendors try to fully abide by the standard, differences in the implementation process might still be found as shown in this paper. The presence of such differences in the implementation process might expose the system to unwanted vulnerabilities, which might be exploited by prying eyes to launch cyber-attacks on the power grid [7,23]. As GOOSE messaging is the base protocol for critical applications such as power systems protection, any vulnerability in the system might lead to devastating consequences, ranging from system disturbances to complete blackouts.…”

Section: Libiec61850mentioning

confidence: 99%

On the Implementation of the IEC 61850 Standard: Will Different Manufacturer Devices Behave Similarly under Identical Conditions?

2016

View full text Add to dashboard Cite

Standardization in smart grid communications is necessary to facilitate complex operations of modern power system functions. However, the strong coupling between the cyber and physical domains of the contemporary grid exposes the system to vulnerabilities and thus places more burden on standards' developers. As such, standards need to be continuously assessed for reliability and are expected to be implemented properly on field devices. However, the actual implementation of common standards varies between vendors, which may lead to different behaviors of the devices even if present under similar conditions. The work in this paper tested the implementation of the International Electro-technical Commission's Generic Object Oriented Substation Event GOOSE (IEC 61850 GOOSE) messaging protocol on commercial Intelligent Electronic Devices (IEDs) and the open source libiec61850 library-also used in commercial devices-which showed different behaviors in identical situations. Based on the test results and analysis of some features of the IEC 61850 GOOSE protocol itself, this paper proposes guidelines and recommendations for proper implementation of the standard functionalities.

show abstract

Section: Libiec61850mentioning

confidence: 99%

On the Implementation of the IEC 61850 Standard: Will Different Manufacturer Devices Behave Similarly under Identical Conditions?

2016

View full text Add to dashboard Cite

show abstract

“…Other work describes attack step sequences that include crafting legitimate but malicious DNP3 packets so that 4 circuit breakers can be opened simultaneously in a 30 bus network [10]. Hoyos et al [8] describe a message authentication attack on a network operating with the IEC-61850 standard and running the GOOSE protocol. Several examples of attacks feasible on Programmable Logic Controllers (PLCs) that run a Modbus protocol are described in the literature [7].…”

Section: Related Workmentioning

confidence: 99%

“…A timing attack on the IEC-61850-8-1 authentication mechanism [8] shows that since the computation capacity of embedded processors for running an authentication algorithm currently exceeds the needed 4ms response time, a successful attack would be able to create an automation breakdown, including damaging circuit breakers and power transformers.…”

Section: Related Workmentioning

confidence: 99%

Exploiting Bro for Intrusion Detection in a SCADA System

Udd

Asplund

Nadjm‐Tehrani

et al. 2016

Proceedings of the 2nd ACM International Workshop on Cyber-Physical System Security

View full text Add to dashboard Cite

Supervisory control and data acquisition (SCADA) systems that run our critical infrastructure are increasingly run with Internet-based protocols and devices for remote monitoring. The embedded nature of the components involved, and the legacy aspects makes adding new security mechanisms in an efficient manner far from trivial. In this paper we study an anomaly detection based approach that enables detecting zero-day malicious threats and benign malconfigurations and mishaps. The approach builds on an existing platform (Bro) that lends itself to modular addition of new protocol parsers and event handling mechanisms. As an example we have shown an application of the technique to the IEC-60870-5-104 protocol and tested the anomaly detector with mixed results. The detection accuracy and false positive rate, as well as real-time response was adequate for 3 of our 4 created attacks. We also discovered some additional work that needs to be done to an existing protocol parser to extend its reach.

show abstract

“…The field StNum is status number, a counter that increments each time a GOOSE message has been sent with any change in the values of the Data Set. The field SqNum is sequence number, containing an incremental counter for each time a GOOSE message has been sent [6]. The field Test indicates if the message is a test or not.…”

Section: Feature Extractionmentioning

confidence: 99%

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

Fu¹,

Tian²,

Yin³

et al. 2018

dtcse

View full text Add to dashboard Cite

Abstract. Generic Object Oriented Substation Events (GOOSE), as an essential component of IEC 61850 communication standard, plays an important role in intelligent substation. Any abnormal change of GOOSE field values could cause substation automatic system failures, incorrect switching, or physical damages in the field devices, which will result in probably catastrophic losses. To mitigate the risks caused by vulnerabilities of GOOSE protocol, a behavior-based intrusion detection system is proposed. Different from the existing proposed approaches, considering there is no attack traffic in intelligent substation network so far, one class classifier is used to model the normal behaviors. Compared to the existing approaches, it can usually detect much more complex attacks. To specify the proposed system, when giving a GOOSE message, we first convert it into a feature vector with a specific approach. Considering only normal GOOSE messages are given, One Class classifier with Extreme Learning Machine (OC-ELM) is used to model the information embedded in the normal training set. Extensive experiments demonstrate the efficiency and effectiveness of the proposed intrusion detection system.

show abstract

Exploiting the GOOSE protocol: A practical attack on cyber-infrastructure

Cited by 103 publications

References 2 publications

On the Implementation of the IEC 61850 Standard: Will Different Manufacturer Devices Behave Similarly under Identical Conditions?

On the Implementation of the IEC 61850 Standard: Will Different Manufacturer Devices Behave Similarly under Identical Conditions?

Exploiting Bro for Intrusion Detection in a SCADA System

An Efficient Behavior-based Intrusion Detection System Using OC-ELM for Intelligent Substation in Smart Grid

Contact Info

Product

Resources

About