RAMBO attack leaks data from air-gapped computers via radio signals from RAM

A paper by security researcher Mordechai Guri, posted to arXiv on 3 September 2024 according to the site's submission history, shows that a computer's memory hardware can be turned into a covert radio transmitter. The technique, dubbed RAMBO, gives malware running on an air-gapped machine a way to send secrets to a nearby attacker without using any network connection. The paper drew renewed attention after a link to it reached the front page of Hacker News.

According to the paper, air-gapped computers are deliberately kept disconnected from wired and wireless networks, an isolation measure used in sensitive environments where leaking confidential information would be costly. RAMBO accepts that such a machine has already been compromised by malware, and concentrates on the step defenders often assume is impossible: getting the data out.

How the attack works

The malware generates radio-frequency signals from the computer's memory buses using nothing but software. By carefully controlling RAM activity, the malicious code produces emissions that encode sensitive information. On the receiving end, an attacker with software-defined radio hardware and a simple off-the-shelf antenna can intercept the raw radio signals from a distance and decode them back into binary data.

Because the transmission comes from standard computer components rather than a dedicated radio, the attack needs no additional hardware on the compromised machine itself.

What can be leaked, and how fast

The paper lists the types of content the channel can carry: files, images, keylogging data, biometric information and encryption keys. Alongside design and implementation details and evaluation results, the author describes fast modification methods that push the channel to 1000 bits per second.

At that rate, roughly 125 bytes per second, short secrets such as encryption keys, credentials or keystroke logs can leave the machine within seconds. Larger payloads are slower: a file on the order of a megabyte would take a couple of hours to exfiltrate, which still matters greatly for compact, high-value data.

Proposed countermeasures

Guri closes the paper with countermeasures intended to blunt this class of exfiltration, framing it as a threat that travels outside the conventional network stack. The abstract does not enumerate the specific defences, so readers will need the full paper for implementation details, but the author positions them as mitigations for this type of out-of-band leakage.

Why it matters

Air-gapping is generally treated as the strongest isolation available: if a machine has no network connection, there is nothing for a remote attacker to reach. RAMBO inverts that assumption by showing that once malware is executing, the hardware itself can act as the network interface. The receiving side requires only software-defined radio equipment and an ordinary antenna, gear that is widely accessible rather than exotic.

The finding also belongs to a broader line of research into side channels that can cross air gaps, which the paper engages through its related-work discussion. For organisations that rely on physical separation for classified, military or industrial systems, the practical lesson is that isolation alone is not a guarantee: software integrity, compromise prevention and emission monitoring remain necessary even on machines that never touch a network.