Discussion
A researcher leaked secrets from an air-gapped PC by making its RAM spell out radio signals...
An air-gapped computer is supposed to be the safe one, with no network and no Wi-Fi. Mordechai Guri of Ben-Gurion University of the Negev showed in a 2024 study on arXiv that its memory can still broadcast. He calls the attack RAMBO, and this weekend it was back on Hacker News with 180 points and 92 comments.
The trick turns the computer's RAM into a radio transmitter.
SecurityWeek reported the signals were captured with a software-defined radio and an off-the-shelf antenna, in tests at up to 7 meters (23 feet). BleepingComputer adds the catch: fast transmissions top out at about 3 meters, and only slow ones work reliably out to 7.
Getting the malware in is the hard part. GovInfoSecurity notes that air gaps are common at military installations and critical infrastructure, and that attackers typically get in through "an infected USB drive or insider threat."
SecurityWeek adds a compromised supply chain. One Hacker News commenter called it a cool paper "even if the attack isn't practical," since it needs malware inside and a receiver within 7 meters.
If you run anything air-gapped, Guri lists the defenses: restricted zones, monitoring for odd memory access, jamming the signal, and Faraday enclosures around the machine. GovInfoSecurity quotes him saying Faraday shielding "can be expensive, and it's not a practical solution for all environments."
GovInfoSecurity also lists restricting physical access and disabling USB ports.
Keep the air gap, then lock the USB ports and decide who can stand within 7 meters of it.
Malware on the machine drives the memory bus so it gives off radio signals, turning them on and off to stand for ones and zeros. Guri's arXiv write-up says the method leaks data "at 1000 bits per second." BleepingComputer put that at 128 bytes per second: a password in 0.1 to 1.28 seconds, a 4096-bit RSA key in 4 to 42 seconds, and keystrokes in real time.
The listener needs very little gear.