IEC 60870-5-104 carries breaker commands between control centres and substations across Europe and beyond, and on most links any host that can reach TCP port 2404 and speak the protocol can send them. The protocol was designed for interoperability on trusted networks: it has no built-in authentication of who sends a command. Industroyer in 2016 and Industroyer2 in 2022 both used it to issue switching commands in Ukraine. The security extensions, TLS under IEC 62351-3 and application-layer authentication under IEC 62351-5, exist but are rarely deployed. This guide covers how 104 works from a defender's view, the realistic threat model, the compensating controls you can apply today, how to plan for TLS and authentication, and how to monitor 104 traffic. It is for utility OT security engineers, SCADA and telecontrol engineers and network teams in transmission, distribution, water and other sectors that use 104.
Key takeaways
- 104 trusts the network: a controlled station accepts any well-formed command from a connected controlling station with the right common address. Security has to come from the network, the hosts and, eventually, IEC 62351.
- Industroyer2 needed no exploit: ESET describes it as implementing only IEC 104, with hardcoded station IP addresses and information object addresses. Once inside the operational network, speaking the protocol was enough.
- Restrict who can open a 104 connection: allowlist controlling station IP addresses on every RTU and gateway, and enforce the same rules on firewalls between control centre, WAN and substation.
- Monitor commands, not just connections: deep packet inspection that knows ASDU type identifications can alert on command types, sources and timings that do not match the operating pattern.
- Plan IEC 62351 as a machine identity programme: TLS and application-layer authentication both depend on certificates or keys for every RTU, gateway and front end, with issuance, renewal and revocation that operations can sustain.
How IEC 104 works, from a defender's view
The IEC webstore lists IEC 60870-5-104:2006 (edition 2.0, published 13 June 2006) as "Network access for IEC 60870-5-101 using standard transport profiles", with a consolidated version including Amendment 1 of 2016. It carries the IEC 60870-5-101 application layer over TCP/IP. The terms below are the ones you need to write rules and read alerts.
| Element | What it is | Security relevance |
|---|---|---|
| Controlling station and controlled station | The control centre front end (often called the master) and the RTU, gateway or IED (the outstation) | The controlled station listens; whoever connects and starts data transfer is treated as a controlling station |
| TCP port 2404 | The registered port for 104 | The port to allowlist and monitor; TLS-protected 104 is commonly run on a separate port such as 19998 |
| APCI frames: I, S and U format | I frames carry data, S frames acknowledge, U frames control the link (STARTDT, STOPDT, TESTFR) | STARTDT from an unexpected host is an early warning sign |
| ASDU and type identification | Application data unit; the type ID says what it is, for example single command, double command, set point, interrogation, clock synchronisation | Commands are a small set of type IDs, which makes allowlisting by type possible |
| Common address of ASDU | Identifies the station or logical device | Commands to an unexpected common address indicate misconfiguration or reconnaissance |
| Information object address (IOA) | Identifies the point: a breaker, a measurement | Industroyer2 modified specified IOAs; sweeps across many IOAs are anomalous |
| Select before operate | Two-step command: select, then execute | Reduces accidental operation; offers no protection against a malicious controlling station |
| General interrogation | Request for the current state of all points | Normal at connection start; repeated interrogation from a new source is reconnaissance |
For the wider grid protocol landscape, including IEC 61850 and DNP3, see the Smart Grid Security Guide; this guide goes deeper on 104 only.
Threat model and lessons from Industroyer
ESET's 2017 analysis of Industroyer described four payload components targeting IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA, and noted that the protocols were designed decades ago when industrial systems were assumed to be isolated, so the attackers did not need protocol vulnerabilities, only to teach the malware to speak them. MITRE ATT&CK (S0604) records that Industroyer was used in the attacks on the Ukrainian power grid in December 2016 and toggled breakers to the open state with unauthorised command messages. ESET's April 2022 analysis of Industroyer2 (ATT&CK S1072) describes malware that implements only IEC 104, stores its configuration in its body (eight device IP addresses, ASDU addresses and IOAs), was compiled on 23 March 2022 and scheduled for 8 April 2022 against high-voltage substations, alongside CaddyWiper and Linux and Solaris wipers. ESET attributes it with high confidence to Sandworm.
| Behaviour | MITRE ATT&CK for ICS | Defensive control |
|---|---|---|
| Sending switching commands from a compromised host | T1692.001 Unauthorized Message: Command Message, T0831 Manipulation of Control | Source allowlists on RTUs and firewalls, command-aware monitoring, IEC 62351-5 authentication |
| Iterating across IOAs to change states | T0806 Brute Force I/O, T0836 Modify Parameter | Alert on bursts of commands or commands to rarely used IOAs |
| Polling stations to learn their state | T0801 Monitor Process State, T0802 Automated Collection, T0888 Remote System Information Discovery | Alert on general interrogation from unexpected sources |
| Impersonating the control centre | T0848 Rogue Master | Restrict controlling station addresses; TLS mutual authentication |
| Wiping SCADA hosts to delay recovery | T0809 Data Destruction | Offline backups of SCADA and RTU configurations; tested restore |
| Reaching an exposed 104 service | T0883 Internet Accessible Device | No 104 on the internet; external attack surface scans |
The common thread is position: in both cases the attackers were already in the operational network before 104 was used. ESET noted that CaddyWiper was deployed through Group Policy, which implies domain-level access. That puts IT to OT segmentation, Windows administration in the control zone and credential hygiene ahead of protocol security in priority, without removing the need for protocol controls.
Compensating controls you can apply now
Most utilities cannot turn on TLS or 62351-5 across their estate quickly because RTUs, gateways and front ends need firmware and licence support on both ends. These controls reduce risk without protocol changes.
- Controlling station allowlists on every outstation: most RTUs and gateways let you configure which IP addresses may connect on 2404. Set only the primary and backup front ends. This is the single most effective control and is often left at "any".
- Firewall rules by host pair: on control centre, WAN and substation firewalls, allow TCP 2404 only from named front ends to named outstations. Deny 104 from engineering workstations and corporate networks; give engineering access its own audited path.
- Protocol-aware firewalls or gateways: where supported, allow only the ASDU type IDs and common addresses each link needs, and block command type IDs on links that should only carry monitoring data (for example to a market or regional reporting system).
- Encrypt and authenticate the WAN: where TLS is not possible on the devices, carry 104 inside IPsec or MACsec tunnels between substation routers and control centre, or a dedicated private network. This protects the path, not the endpoints: a compromised front end can still send commands.
- Harden the front ends: SCADA front end processors and protocol gateways are the hosts Industroyer-class malware needs. Apply application allowlisting, remove internet access, restrict interactive logons and monitor for new executables and scheduled tasks.
- Interlocks and operational limits: protection and local interlocks that refuse unsafe states are the last line of defence; review that they do not depend on the same 104 path.
Planning IEC 62351-3 TLS and 62351-5 authentication
IEC 62351 adds security to the IEC TC 57 protocols. For 104 two parts matter: Part 3 profiles TLS for TCP/IP-based protocols, and Part 5 adds application-layer security for IEC 60870-5 and its derivatives, so that authentication survives gateways that terminate TLS. Both are paywalled standards; the summary here is at the level of public descriptions, and the IEC 62351 Power System Communications Security Guide covers the parts, editions and dependencies in detail.
| Option | Protects against | Does not protect against | Prerequisites |
|---|---|---|---|
| Network allowlists and firewalls | Commands from hosts outside the allowed set | A compromised allowed front end, spoofing on the local segment | Accurate inventory of links |
| IPsec or MACsec on the WAN | Eavesdropping and injection on the WAN | Compromise of either endpoint or the substation LAN | Router support, key management |
| IEC 62351-3 TLS on 104 | Injection and tampering on the path; unauthenticated peers (with mutual authentication) | A compromised authenticated endpoint; segments after a terminating gateway | TLS-capable firmware at both ends, device certificates, revocation checking |
| IEC 62351-5 application-layer authentication | Commands not authenticated by the controlling station's keys, end to end across gateways | A compromised station that holds valid keys | Support at both ends, key management per association |
- Inventory: list every 104 association: front end, outstation, common address, path, firmware version and whether TLS or Part 5 is supported.
- Procure for it: write IEC 62351-3 and 62351-5 support, with edition, into every new RTU, gateway and SCADA purchase, including certificate enrolment and revocation checking.
- Build the PKI first: device certificates with an operational issuing CA, lifetimes that match maintenance cycles, and a revocation method that works when the WAN is degraded.
- Pilot on one link: enable TLS between one front end and one outstation, run in parallel with the plain link, and test failover, certificate expiry and revocation behaviour.
- Roll out by region: convert links as firmware is upgraded, keeping plain 104 only as a documented, time-limited exception.
- Rollback: keep the plain 104 configuration ready on both ends and a procedure to revert a link under operational authority if a certificate failure stops telecontrol. Track every reversion.
Small versus large utilities: a small distribution or water utility with a few dozen RTUs will usually get most value from allowlists, an encrypted private WAN and monitoring, and adopt TLS at the next SCADA replacement. A transmission operator with thousands of associations needs a multi-year 62351 programme with a dedicated PKI team.
Where identity fits
Every party in a 104 association is a machine. Without 62351, the only identity is an IP address and a common address, both easily misused from inside the network. With 62351, each RTU, gateway and front end needs a certificate or key, and the security of every command depends on how those are issued, stored and revoked. Front end servers also run under Windows or Linux service accounts that, if compromised, can send any command the front end can. Treat these as privileged non-human identities: inventory them, restrict interactive use, and monitor their logons. See the Device and IoT Identity Guide.
Detection and monitoring
104 is well suited to monitoring because traffic is regular: the same front ends poll the same stations with the same type IDs. Passive OT monitoring tools with 104 dissectors can build that baseline.
- New peers: any TCP 2404 connection or STARTDT from a host that is not a known front end.
- Command anomalies: command type IDs (single and double commands, set points) from a new source, outside operating hours, to unusual IOAs, or in bursts across many IOAs.
- Interrogation from new sources: general interrogation requests not issued by the usual front ends.
- Link behaviour: repeated STOPDT and STARTDT, frequent reconnections or unexpected clock synchronisation commands.
- Host signals on front ends: new executables, services or scheduled tasks, Group Policy changes and process termination of SCADA services, all patterns ESET described in Industroyer2.
- Correlate with operations: every command should match an operator action, an automatic scheme or a scheduled job in SCADA logs.
Metrics
- Percentage of outstations with controlling station IP allowlists configured.
- Percentage of 104 associations protected by TLS or 62351-5.
- Number of firewall rules allowing TCP 2404 from broader than a named host.
- Percentage of 104 links covered by passive monitoring with command alerts.
- Mean time to investigate an unmatched command alert.
- Percentage of RTU and front end configurations with a tested offline backup.
Responding to suspicious 104 activity
- Confirm with operations first: check whether the command matches an operator action, switching schedule or automatic scheme before treating it as hostile, and agree in advance who in the control room can make that call.
- Contain at the network, not the process: block the unexpected source at the firewall or remove its route, rather than disabling telecontrol to the affected substations, unless the grid operator decides manual operation is safer.
- Move to manual or local control where needed: have field crews and local control procedures ready, as Ukrainian operators relied on in 2016.
- Preserve evidence: capture packet data from monitoring sensors, front end and gateway logs and memory before rebuilding hosts, and record the IOAs and type IDs involved.
- Restore from known good: rebuild front ends from offline images and reload RTU configurations from verified backups, then re-verify allowlists before reconnecting.
Framework mapping
| Control | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Controlling station allowlists and host pair firewalls | SC-7 Boundary Protection, AC-4 Information Flow Enforcement | PR.IR |
| TLS and WAN encryption | SC-8 Transmission Confidentiality and Integrity, SC-23 Session Authenticity | PR.DS |
| Device authentication and certificates | IA-3 Device Identification and Authentication, SC-17 Public Key Infrastructure Certificates | PR.AA |
| Front end hardening | CM-7 Least Functionality, CM-6 Configuration Settings | PR.PS |
| Protocol monitoring | SI-4 System Monitoring | DE.CM |
| Configuration backup and recovery | CP-9 System Backup, CP-10 System Recovery and Reconstitution | RC.RP |
Common failure patterns
- Outstations accept any controlling station: allowlists exist in firmware but were never configured.
- Flat control networks: engineering workstations, historians and front ends share a segment that can reach every RTU on 2404.
- Monitoring connections only: NetFlow shows a known pair of hosts, but no one inspects which commands were sent.
- TLS without lifecycle: TLS enabled on a pilot with long-lived certificates and no revocation, then quietly disabled when a certificate expires.
- 104 exposed beyond the utility: remote sites reachable over cellular or internet links without a VPN.
- No offline restore: SCADA and RTU configurations backed up only to systems that a wiper would also destroy.
Practitioner checklist
- Inventory every 104 association with endpoints, common address, path and firmware capability.
- Configure controlling station IP allowlists on every RTU and gateway.
- Restrict TCP 2404 on firewalls to named host pairs and block it from IT and engineering networks.
- Encrypt WAN paths that carry plain 104.
- Harden and monitor SCADA front ends and protocol gateways as privileged hosts.
- Deploy passive monitoring with 104 command-level alerts and correlate with SCADA logs.
- Write IEC 62351-3 and 62351-5 support into all new procurement and build the device PKI.
- Keep tested offline backups of SCADA and RTU configurations.
Standards and references
- IEC: IEC 60870-5-104:2006 Network access for IEC 60870-5-101 using standard transport profiles
- MITRE ATT&CK: Industroyer2
- MITRE ATT&CK: Industroyer
- MITRE ATT&CK for ICS: Unauthorized Message: Command Message
- ESET WeLiveSecurity: Industroyer2: Industroyer reloaded
- ESET WeLiveSecurity: Industroyer: Biggest threat to industrial control systems since Stuxnet
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Smart Grid Security Guide · IEC 62351 Power System Communications Security Guide · OT Security Guide · OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide