RAMBO attack leaks air-gapped computer data via radio signals from RAM

A paper submitted to arXiv on 3 September 2024 (Cryptography and Security) presents RAMBO, an attack aimed at air-gapped computers. These are machines kept physically separate from external networks, including the Internet, with no wired or wireless connection to other devices. Such isolation is used in sensitive environments where security is critical to prevent private and confidential information from leaking.

The paper's central claim is that malware on a compromised computer can generate radio signals from the memory buses (RAM). The malware can encode sensitive information into these software-generated signals. The paper lists files, images, keylogging data, biometric information and encryption keys as examples.

On the receiving side, an attacker needs software-defined radio (SDR) hardware and a simple off-the-shelf antenna. With these the attacker can intercept the transmitted raw radio signals from a distance. The signals can then be decoded and translated back into binary information. The abstract gives no distance figure.

The paper covers the design and implementation of the attack, related work and evaluation results. It presents fast modification methods that leak data from air-gapped computers at 1000 bits per second. The abstract does not say whether that is a maximum, an average or a median, nor which hardware or RAM types were tested. Finally, the authors propose countermeasures to mitigate what they call an out-of-band air-gap threat; the abstract does not describe them.

Key facts

RAMBO is an attack in which malware on an air-gapped computer makes the memory bus (RAM) emit radio signals that encode data.
The paper lists files, images, keylogging, biometric information and encryption keys as data the malware can encode.
An attacker needs SDR hardware and a simple off-the-shelf antenna to intercept the signals from a distance and decode them back into binary information.
The paper's fast modification methods leak data at 1000 bits per second.
The paper, submitted to arXiv on 3 September 2024, also proposes countermeasures against this out-of-band air-gap threat.

Why it matters

Air-gapping is the standard protection for sensitive environments, built on the idea that a machine with no network link cannot send data out. RAMBO is a demonstration of a covert channel that bypasses the network entirely: the data leaves as radio emissions generated by ordinary software activity on the memory bus. The paper frames this as an out-of-band threat to air-gap measures.

Who it affects

The paper points to environments where security and isolation are critical to prevent private and confidential information leakage, which is where air-gapped systems are used. Operators of such systems and the people who design their physical and electromagnetic protections are the audience for the result.

How to use it

This is a research result, not a tool. For defenders, the practical takeaway is that the paper proposes countermeasures to mitigate the threat. The abstract does not describe them, so anyone assessing exposure should read the full paper (PDF and HTML versions are linked on the arXiv page) for the countermeasures and the evaluation details.

How solid is it

The source is an arXiv preprint abstract in the Cryptography and Security category. The authors report evaluation results and a rate of 1000 bits per second for their fast modification methods. The abstract does not state the hardware or RAM types tested or the conditions behind that figure, and no distance range is given, only 'from a distance'. The claims here are the paper's own.

Risks and caveats

The attack requires malware already running on the air-gapped computer; the abstract does not say how the malware would get there. No real-world exploitation or incident is reported, and this is a research paper. 1000 bits per second is a slow channel by network standards, though the paper names small items such as keylogging data and encryption keys among what can be sent. No vendor responses are mentioned.

“We show that malware on a compromised computer can generate radio signals from memory buses (RAM).”

— RAMBO paper abstract, arXiv, 3 Sep 2024