QUT ePrints (Queensland University of Technology) · 2014 · 59 citations · 3 references
Open access
ComputingComputer ScienceCybersecurityComputer SecurityNetwork SecuritySecurity ProtocolsCommunication Network ProtectionDenial Of Service VulnerabilitiesDenial-of-service AttacksInternet Protocol SecurityNetwork Protocol VulnerabilitiesAttack MitigationCommunication Protocol DesignDenial-of-service MitigationDenial-of-service Vulnerability AnalysisFramesInternet Protocol VulnerabilitiesProtocol Exploitation AttacksSubstation Automation Security
This paper presents a vulnerability within the generic object oriented substation event (GOOSE) communication protocol. It describes an exploit of the vulnerability and proposes a number of attack variants. The attacks sends GOOSE frames containing higher status numbers to the receiving intelligent electronic device (IED). This prevents legitimate GOOSE frames from being processed and effectively causes a hijacking of the communication channel, which can be used to implement a denial–of–service (DoS) or manipulate the subscriber (unless a status number roll-over occurs). The authors refer to this attack as a poisoning of the subscriber. A number of GOOSE poisoning attacks are evaluated experimentally on a test bed and demonstrated to be successful.
3