{
  "id": 4853121,
  "title": "IEC 61850 Security Research: From SCL and MMS to GOOSE, Sampled Values, and the Process Bus",
  "url": "https://urgent.news/2026/09/01/iec-61850-security-research-from-scl-and-mms-to-goose-sampled-values",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-01T11:55:08.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/null_saint/iec-61850-security-research-from-scl-and-mms-to-goose-sampled-values-and-the-process-bus-bnp"
  },
  "original_language": "en",
  "account": "IEC 61850 is a complex industrial protocol that reveals its true nature upon deeper examination. At first glance, it appears to be another protocol to analyze, but it is actually an ecosystem of communication models rather than a single protocol. The research focused on three main aspects: SCL configuration, MMS sessions, and GOOSE/Sampled Values (SV) behavior.\n\nThe SCL configuration represents the attack surface for the IEC 61850 system, as it describes IED capabilities, logical nodes, communication parameters, datasets, and relationships between devices. This configuration serves as the foundation for subsequent MMS and process-bus experiments, establishing a reference against which observed behavior can be interpreted.\n\nIn the MMS phase, the laboratory IED exposed MMS through ISO-on-TCP on port 102. Enumeration of the MMS information model revealed a structured hierarchical model, composed of logical devices, logical nodes, data objects, and control points. The server exposes this model after session establishment, indicating that clients are interacting with a structured information model. This raises important questions about which parts of the model can be manipulated by the client.\n\nFinally, the research examined control operations within the MMS framework. Direct writes to control values were initially rejected by the server due to data typing and control semantics. However, a properly constructed control operation could alter the simulated control state without enforcing authentication mechanisms. This distinction is crucial, as it demonstrates that a protocol implementation can be manipulated despite the absence of proper security measures.",
  "summary": "By RUGERO Tesla ( @404Saint ). IEC 61850 is another one of those protocols that becomes more interesting the deeper you go. At first glance, it looks like another industrial protocol to dissect: identify the transport, decode the messages, enumerate the data model, and look for places where authentication or authorization is missing and that description turns out to be inadequate. IEC 61850 is an…",
  "key_points": [
    "IEC 61850 is an industrial protocol ecosystem, not a single protocol",
    "SCL configuration defines attack surface and MMS foundation",
    "GOOSE/Sampled Values manipulation bypasses authentication"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}