Cyber Vulnerabilities in ATE Systems

Automatic Test Equipment (ATE) is a complicated system containing complex test instruments capable of automatically testing and diagnosing faults in sophisticated electronic packaged parts. As technology has evolved, ATE systems have evolved through their usage of communication interfaces (parallel, serial, Ethernet, MXI, PXI), station instrumentation (VME, VXI, PXI-based), and selection of station controllers/computers (personal computers, laptops) to run the ATE system. While these changes have enhanced the ATE system and have been necessary to keep up with the current technology, this advancement has also introduced Cyber Vulnerabilities into the ATE system components. With the addition of complex operating systems, USB, and Ethernet ports, into ATE components, the cyber-attack surface area increases in ATE systems. All of the additional features, have transformed the ATE system into a collection of small computers that inherit many of the same attack vectors that a system administrator of a large enterprise network would have to defend against. An example of an additional attack vector that ATE devices have in common with an enterprise systems is the USB port. Stuxnet, a malicious computer worm that was discovered in 2010, is perhaps the most famous cyber-attack via a USB port injection. The worm was introduced to the target environment via an infected USB flash drive, thereby crossing any air gap. Once injected into the target system, the worm then propagated across the network, scanning for specific software and devices. Machines that used the Microsoft Windows operating system were the primary targets for the Stuxnet worm. This worm ultimately attacked the programmable logic controllers (PLCs) of the target system. If a worm, such as Stuxnet, were to be injected into an ATE system component, like an oscilloscope or function generator, that worm could propagate to the Unit/Device Under Test (UUT/DUT). Once at the UUT, if the worm is not detected, the UUT could pass all automated tests and then be released through the supply chain to enter into a production environment. In order to reduce the risk of a Stuxnet-like worm infecting an ATE system, cyber hardening and cyber monitoring for cyber-attack effects need to be researched and implemented in an ATE system. The most effective fashion to implement these cyber hardening and cyber monitoring techniques is to ensure that cyber survivability and cyber hardening are considered during the design phase of an ATE system. Cyber hardening and cyber monitoring design augmentations of the ATE system are necessary in order to ensure that the ATE system is hardened and can monitor for cyber-attacks and effects in a manner that balances the performance of the ATE system with the security, making it harder for an attacker to gain access to the ATE system.