IEC 60870-5-104 is the TCP/IP adaptation of IEC 60870-5-101, a protocol originally designed for serial communication between substation RTUs and control centres. The 104 variant carries the same application data units (ADUs) over a standard TCP connection, making it suitable for IP-networked substations and wide-area SCADA deployments. It runs on TCP port 2404 and is the dominant protocol for power grid control traffic in Europe, Asia, and Latin America — serving the same role in these regions that DNP3 serves in North America.
The security properties of the base IEC 104 specification are similar to Modbus, DNP3, and other pre-cybersecurity-era industrial protocols: there is no authentication, no encryption, and no mechanism to verify that commands originate from a legitimate master. Any device on the network with TCP access to port 2404 can read real-time process values and send control commands to the remote terminal unit.
Protocol Structure
IEC 104 frames are called APDUs (Application Protocol Data Units). An APDU consists of an APCI (Application Protocol Control Information) header and an ASDU (Application Service Data Unit) carrying the actual data.
The APCI is 6 bytes and carries a type field (I-format, S-format, or U-format) and sequence counters for flow control. The ASDU contains:
- Type ID: specifies the data type (e.g.,
1= single-point information,45= single command,100= general interrogation command) - Cause of Transmission (COT): why the message is being sent (cyclic, spontaneous, interrogation response, activation, etc.)
- Common Address of ASDU (CA): identifies the RTU
- Information Object Address (IOA): identifies the specific data point (sensor or actuator)
- Value or Command: the actual data
For an attacker, the ASDU structure defines the attack surface: they need to know the CA and IOA of the target, the correct type ID for the command they want to send, and the COT for an activation command. All of these can be learned passively by observing normal traffic.
Attack Surface
Unauthorised read: A device on the network can issue a General Interrogation Command (Type ID 100, COT 6 — Activation) to the RTU. The RTU will respond with its full current state — every data point it monitors, including circuit breaker status, power measurements, transformer tap positions, and alarm states. This gives an attacker a complete picture of substation state without any credentials.
Unauthorised command: Single Command (Type ID 45) and Double Command (Type ID 46) are used to operate circuit breakers, transformer tap changers, and other actuators. An attacker who sends a correctly formatted Single Command with the appropriate CA and IOA will cause the RTU to execute the command and operate the physical equipment.
Session injection: IEC 104 sessions are identified by TCP connection rather than any application-layer identity. An on-path attacker can inject APDUs into an existing session or establish their own parallel session to the RTU — the RTU has no way to distinguish them.
Man-in-the-middle: Without encryption, all traffic is in cleartext. An attacker with network access between the control centre and substation can read all measurements and commands, modify values in transit, or replay commands.
Replay attacks: With no time-stamped nonces or session tokens on commands, a captured command sequence can be replayed to repeat previous actions — circuit breaker operations, for example.
Known Exploitation in the Wild
The most significant documented exploitation of IEC 104 (or its serial predecessor IEC 101) occurred during the Ukraine power grid attacks of December 2015 and 2016, attributed to Sandworm/Industroyer. The Industroyer/Crashoverride malware framework contained a specific module implementing the IEC 104 protocol, used to send commands to substation equipment and cause power outages affecting hundreds of thousands of customers. The IEC 104 module was capable of issuing command messages to trip circuit breakers without requiring the attackers to understand the specific IOA configuration of each substation — it sent commands to all possible IOAs systematically.
The FrostyGoop/BustleBerm malware discovered in 2024 similarly targeted IEC 104 controllers in Ukrainian district heating infrastructure. These incidents demonstrate that nation-state actors have operational IEC 104 attack capabilities and are prepared to use them against critical infrastructure.
Hardening Measures
Network segmentation and access control: IEC 104 RTUs should not be reachable from corporate IT networks or the internet. Network firewalls at the Purdue Level 3/Level 2 boundary should explicitly whitelist only the control centre server IP addresses as permitted to connect to port 2404 on RTU addresses. Any connection attempt from an unexpected source should generate an alert.
# Example firewall rule (iptables notation)
iptables -A FORWARD -p tcp --dport 2404 -s <control_center_IP> -d <RTU_subnet> -j ACCEPT
iptables -A FORWARD -p tcp --dport 2404 -j DROPIEC 62351 for authentication: IEC 62351 Part 5 defines authentication extensions for IEC 60870-5 protocols, including IEC 104. The extension adds a Challenge/Response mechanism that prevents command injection without knowledge of a shared secret. Implementation requires IEC 62351-5-capable RTU firmware (available from major vendors including ABB, Siemens, and GE) and a control centre that supports the challenge protocol. Deployment remains uneven — many installed RTUs pre-date IEC 62351 support and require firmware updates or hardware replacement.
TLS transport wrapping: Where IEC 62351 authentication is not feasible, TLS wrapping of the IEC 104 TCP session provides confidentiality and transport-layer authentication. This requires a TLS-capable middleware component or an RTU firmware version supporting TLS. The control centre and RTU must both support TLS and have certificates issued from an appropriate PKI. This addresses MitM and eavesdropping but does not prevent command injection from a client with a valid certificate.
Unidirectional security gateways: For substation monitoring where operational commands need not traverse the network, unidirectional gateways (data diodes) allow telemetry to flow from the substation to the control centre without permitting any return traffic path. Waterfall Security Solutions and similar vendors produce devices certified for this use case. This architecture eliminates command injection entirely but requires that all control commands use an alternative path or are not sent remotely.
Passive network monitoring: OT-specific intrusion detection systems (Claroty, Dragos, Nozomi Networks, Fortinet FortiSIEM OT) can parse IEC 104 at the ASDU level. Detection rules that alert on:
- General interrogation commands from unexpected source IPs
- Command-type APDUs (Type IDs 45, 46, 47, 48) sent outside of normal maintenance windows
- High-frequency command sequences inconsistent with normal operational profiles
- APDU sequence number anomalies indicative of injection or replay
These detections require a learning period to establish baseline command profiles but provide meaningful anomaly detection once baselines are established.
RTU firmware patching: Vendor-specific vulnerabilities in IEC 104 server implementations have been disclosed against multiple RTU and SCADA gateway products. CISA ICS-CERT advisories should be monitored for relevant CVEs against deployed RTU hardware. Firmware patching in substation environments requires careful change management but should not be deferred indefinitely.
Protocol Deep-Dive: Identifying Suspicious Traffic
For OT security engineers performing traffic analysis, the following ASDU characteristics indicate potential hostile activity:
| Indicator | Normal | Suspicious |
|---|---|---|
| Command Type IDs | Rare outside maintenance | Frequent Type 45/46/47/48 |
| COT for commands | Activation (COT=6) only during ops | Activation from unexpected IP |
| General Interrogation | Only from SCADA server | From any other host |
| IOA range | Bounded to known data points | Sequential sweep of all IOAs |
| Transmission rate | Cyclic with defined period | Burst or aperiodic |
Wireshark with the IEC 104 dissector (Edit → Preferences → Protocols → IEC 104) decodes ASDU fields natively and is useful for ad hoc traffic analysis during incident investigation.
Sector-Specific Considerations
Transmission and distribution utilities: The operational consequences of unauthorised IEC 104 command execution can include circuit breaker tripping, transformer operations, and protection relay manipulation. Any OT security programme for power utilities must treat IEC 104 access control as a critical control with physical safety implications.
Railway electrification systems: IEC 104 is used in some railway traction power control systems. Loss of control availability or unauthorised operation of traction substations has direct safety implications for rail operations.
Water infrastructure: Some water utility SCADA deployments use IEC 104 for pumping station telemetry. The attack surface is similar, though the operational consequences differ.
Given the critical nature of power grid infrastructure and the demonstrated use of IEC 104 attack capabilities by nation-state actors, utilities should treat any deviation from baseline IEC 104 traffic as a high-priority incident requiring immediate investigation.