Researchers made malware turn an air-gapped computer’s memory activity into radio signals carrying stolen data.

The Story

RAMBO makes air-gapping a barrier, not a guarantee: malware and a nearby radio receiver are still required.

RAMBO is a proof-of-concept side channel, not a way to reach every isolated computer remotely. The machine must first be compromised, the receiver must be nearby, and the signal must be detected and decoded. The paper and coverage establish feasibility under test conditions; they do not establish uniform performance across hardware, rooms, or defensive setups.

• Attack chainThe attacker needs a foothold on the isolated machine before RAM can be used as a transmitter.
• Operational limitsReceiver distance, hardware differences, environmental interference, and data rate determine whether the channel is useful.
• Defensive focusProtecting removable-media pathways and monitoring unusual electromagnetic behavior become relevant alongside network isolation.

• The paper describes malware generating radio signals from memory buses and encoding sensitive information for capture with an SDR and antenna.arxiv +1
• The reported demonstration transmitted data at up to 1,000 bits per second and was tested over distances up to 7 meters.doi +1
• Earlier work shows that other electromagnetic covert channels can operate through ordinary user-level processes and be received by nearby devices.doi