IEC 60870-5-104 Detection Scanner

This scanner detects the use of IEC 60870-5-104 vulnerability in digital assets. It helps identify the presence of the IEC 60870-5-104 ICS protocol.

Short Info


Level

Critical

Single Scan

Single Scan

Can be used by

Asset Owner

Estimated Time

10 seconds

Time Interval

4 weeks

Scan only one

Domain, IPv4

Toolbox

-

The IEC 60870-5-104 protocol is widely used in industrial control systems (ICS) for communication between devices in utilities and infrastructure sectors. It allows remote control and monitoring of critical operations in power plants, water treatment plants, and other industrial facilities. The protocol is known for supporting communication over TCP/IP networks, facilitating secure and efficient data exchange. It's typically implemented in SCADA systems for process automation and telemetry. Many modern ICS systems rely on this protocol to manage operations in real-time. Vulnerabilities in this protocol can lead to significant risks for infrastructure safety and security.


This scanner detects the presence of the IEC 60870-5-104 protocol in digital assets, specifically checking for vulnerabilities in the communication process. The detection is based on the ability to identify specific message types used in the protocol, such as the TESTFR and STARTDT messages. It is important to detect this vulnerability, as exploitation may result in unauthorized access to or manipulation of critical infrastructure. The detection process involves sending and receiving specific test frames to check for protocol-specific responses. The scanner identifies whether the endpoint is responding correctly to these tests, indicating if the protocol is active. Any failure or anomaly in responses might indicate a misconfiguration or vulnerability in the system.


The script works by attempting to interact with the IEC 60870-5-104 protocol over TCP, sending a series of test frames and commands to establish a valid connection. It first sends a TESTFR frame to determine whether the system is using the IEC 60870-5-104 protocol. If the system responds with the correct acknowledgment, it proceeds to send the STARTDT message to initiate data transfer. After this, the script sends further commands to retrieve information from the system. The response from the system is analyzed for specific patterns, which are indicative of the IEC 60870-5-104 protocol in use. If the responses match expected patterns, the vulnerability is confirmed, and the scanner reports the results.


If a vulnerability in the IEC 60870-5-104 protocol is exploited, malicious actors could gain unauthorized access to industrial control systems. This could lead to unauthorized monitoring, manipulation, or disruption of critical operations. Exploiting the protocol vulnerability may also result in unauthorized data extraction or manipulation, compromising the integrity of industrial processes. In severe cases, it could lead to system downtime or physical damage to infrastructure. It is critical to patch any identified vulnerabilities to prevent such exploitation, as these could have severe consequences on safety and service continuity. Malicious actors could use this vulnerability to perform denial of service attacks or unauthorized configuration changes.


References:


Get started to protecting your Free Full Security Scan