New RAMBO Attack Allows Air-Gapped Data Theft via RAM Radio Signals

An academic researcher has devised a new method of exfiltrating data from air-gapped systems using radio signals from memory buses.

An academic researcher has devised a new attack technique that relies on radio signals from memory buses to exfiltrate data from air-gapped systems.

According to Mordechai Guri from Ben-Gurion University of the Negev in Israel, malware can be used to encode sensitive data that can be captured from a distance using software-defined radio (SDR) hardware and an off-the-shelf antenna.

The attack, named RAMBO (PDF), allows attackers to exfiltrate encoded files, encryption keys, images, keystrokes, and biometric information at a rate of 1,000 bits per second. Tests were conducted over distances of up to 7 meters (23 feet).

Air-gapped systems are physically and logically isolated from external networks to keep sensitive information safe. While offering increased security, these systems are not malware-proof, and there are at tens of documented malware ...