Saturday, October 14, 2017

Hopeless: Relay Protection for Substation Automation

Small present for all Digital Substations, IEC 61850 and Remote Code Execution lovers by Kirill Nesterov @k_v_nesterov and Alexander Tlypov @_Rigmar_

Digital Substation is an essential part of every electrical network. It is also a base ground for modern Smart Grid technologies. More than 4000 of IEC 61850 compatible substations operated in Europe, 20 000+ worldwide, each of the comprising communication and flow of gigawatts of electrical current between large power plants (thermoelectrical, hydroelectrical or even nuclear) and their respective consumers. Such consumers include cities, industrial objects and power plants themselves.

During this talk we will focus on security analysis results of key Digital Substation component - Relay Protection Terminals. Protective relays are devices for detection of electrical faults. When such fault is detected relay device designed to trip a circuit breaker. Without them problems like over-current, over-voltage, reverse power flow, over-frequency, and under-frequency can lead to colorful and impressive pictures of giant electric arcs accompanied by bunch of sparks with total blackouts as a result.

Nowadays protective relays became digital devices with network access through which operators can access different services like self-testing, statistics, logs and others. More of it, electrical lines are also combined with fiber-optic lines for communications. Electrical part of such lines need minimal traffic, but protection against surges. So such lines can be leased to different organizations, exposing great target for attacker. All of services inside such networks are available through different industrial protocols like IEC 61850 (MMS, GOOSE), IEC104 and Modbus, a not very industrial protocols HTTP, FTP, SSH and everybody’s favorite proprietary protocols. We will show how to dig very deep inside Relay Protection Terminal and how to abuse numerous weaknesses and vulnerabilities inside.

Slides and toolkit as presented on Recon 2017.



  1. To get the best bed frame or mattress foundation, you need to know the type and quality of your mattress that you are using or going to use. You can use some mattresses with and some without a frame or foundation. However, we recommend using a foundation for every mattress whether the manufacturer instructed to use or not. We believe, a quality foundation can ensure more sagging prevention and longevity. But for that, you need to find out a perfect unit from the huge numbers of available models and brands out there on the market. The Zinus 14 Inch SmartBase Mattress Foundation can narrow down your choices.

  2. Good information posted .Thanks for sharing information.
    SCADA Security Managaer

  3. Please let me know if you're looking for a article writer for your weblog. You have some really good articles and I think I would be a good asset. If you ever want to take some of the load off, I'd absolutely love to write some material for your blog in exchange for a link back to mine. Please blast me an e-mail if interested. Many thanks!it security melbourne

  4. Thank you for sharing the blog, this blog is really nice blog and useful for students. In industry automation is very useful and need. sage automation provide the training and work on live project for industrial automation etc. More details visit us

  5. Great post!
    Is there a video recording of this presentation?



  6. Thanks a lot very much for the high quality and results-oriented help. I won’t think twice to endorse your blog post to anybody who wants and needs support about this area.

    Best RPA Training in Bangalore