Loading today’s stories
Build1 distinct publisher2 min readPublished
A packet-level lab study drives an IEC 104 server from a connected socket into data transfer with one unauthenticated frame, then measures what TLS and mTLS actually move.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
The bytes are almost anticlimactic. A six-octet frame, 68 04 07 00 00 00, is STARTDT ACT; the server answers 68 04 0B 00 00 00, STARTDT CON, and the link is in data transfer [9][10]. What sits between those two messages is the finding, and it is nothing: no identity negotiation, no credential exchange, no cryptographic challenge, and no authentication step stands between a connected socket and an active application channel [11].
That gap is why the usual framing misleads. The common discussion treats the exposed listener on port 2404 as the boundary and stops there [2], but the architecture keeps the TCP transport and the IEC 104 application protocol as separate layers [5], and a connected socket does not by itself let application data flow [7]. Against the lab target on 127.0.0.1:2404 the session sat in a stopped state until a single unauthenticated U-frame promoted it [8]. Admission is decided by the APCI state machine, and that machine asks for no proof of who is asking. The base protocol supplies the transition, not an authentication boundary [12].
Once the channel was active, the observable behaviour made the point concrete. Against a lib60870-C server running cs104_server_no_threads [13], the capture showed cyclic telemetry the client never requested: a Type 11 object at common address 1, IOA 110, whose payload stepped from 0xcc0300 to 0xce0300, a live counter on the wire [14]. Reading it is not a send-then-receive exercise, because several APDUs can share one TCP segment and the client has to run its own stream parser to separate them [15].
This is where the comparison against IEC 62351 TLS and mTLS earns its place [4][3]. Those mechanisms wrap the transport, so a certificate check governs who may open the pipe. They do not rewrite the STARTDT transition. Encrypting the channel and authenticating the endpoint move the decision to the transport handshake; the state machine underneath still admits whoever reaches data transfer [12]. The study's value is locating the missing check at the application layer, where transport security does not reach [5].
Ranked by verification strength, evidence, and original report placement.
The lab was built around lib60870-C, driven with raw Python protocol harnesses rather than only a high-level client, captured with Wireshark, and the cleartext behavior compared against a separate TLS/mTLS security lab.
A stated objective was to compare IEC 104 behavior against IEC 62351 security mechanisms to determine where the security boundary actually exists at each layer.
The server under test was lib60870-C running cs104_server_no_threads.
A packet-level security study of IEC 60870-5-104 by RUGERO Tesla (@404Saint), combining protocol architecture, raw APCI/ASDU experimentation, implementation boundary testing, and a controlled comparison against IEC 62351 mechanisms.
The author frames the study as deliberately going below the usual 'port 2404 is exposed' discussion of IEC 104 security.
IEC 60870-5-104 extends the IEC 60870-5 telecontrol family over TCP/IP, and its architecture separates the TCP transport from the IEC 104 application protocol and its APCI framing.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Specific artefacts, one unverified lab
The claims are unusually concrete for a single-source item: exact frame bytes, state transitions, ASDU addresses and payload progression, with Wireshark figures cited and artefacts said to be published in a research directory. But everything rests on one self-published post describing one isolated localhost lab against a single open-source reference example server, with no independent replication, no peer or vendor review, and a body that truncates before the promised IEC 62351 TLS/mTLS results.
No adoption signal in supplied material
The cluster contains no release, deployment, benchmark, incident, pricing or usage-disclosure evidence. lib60870-C appears only as a lab target, and there is no data on how widely IEC 104 or IEC 62351 security extensions are deployed, so no adoption level can be measured without inventing facts.
Mildly overstated generalisation
The substantive finding — that base IEC 104 has no authentication step between TCP connect and link activation — is accurately demonstrated and is consistent with the protocol's documented design, so it is not fabricated. The overstatement is in scope: a single localhost run against a reference example server is presented as establishing where 'the real security boundary' of IEC 104 sits, and the framing promises measurement of what TLS and mTLS move while the supplied text never delivers those results. No deployment or exposure evidence backs the implied real-world stakes.
Low commercial pressure, personal-visibility incentive
The item is an individually authored research write-up on a developer publishing platform with a named handle and pointers to the author's own research artefacts, so the main incentive is professional visibility and portfolio building rather than product or vendor promotion. No sponsor, vendor, product being sold, funding round or paywalled offering is disclosed anywhere in the supplied material, which keeps distortion pressure modest; the absence of an editorial or peer check is the main residual risk.
Moderate-low: single self-reported source
Confidence is capped by structure rather than by internal quality: one publisher, one source, one lab, no independent verification, and a truncated body. Within those limits the protocol-architecture and byte-level claims are precise and internally consistent, so the mechanism-level findings can be relied on more than the generalising headline or any real-world exposure implication.
security
CISA's Ebyte advisory carries no fixed version, because the vendor stopped answering1 distinct publisher
security
Johnson Controls console holds passwords in cleartext memory, and the fix line names two versions1 distinct publisher
security
Siemens IoT2050 gateways ship a Node-RED interface that asks nobody for a password1 distinct publisher
security
U.S. warning on Siemens S7 PLCs: AI-written scripts, borrowed scan data, read access first1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 25, 2026