For an air-gapped computer, the usual rule is simple: data crosses the boundary only when someone carries it across by hand. The machines are physically separated from external networks, including the Internet.
A paper by Mordechai Guri argues that malware already running inside such a machine can create another route out. It can use activity in random-access memory, or RAM, to generate radio signals that carry encoded secrets to a receiver outside the isolated system.
The paper, titled ‘RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM’, was submitted on 3 Sep 2024. This version of the work was accepted to Nordic Conference on Secure IT Systems, 2023.
Guri is a Senior Lecturer at Ben-Gurion University of the Negev in Software and Information Systems Engineering. He heads the Offensive Cyber Research Lab, is CEO of AIRGAPIX.COM, and is co-founder and Chief Science Officer of Morphisec. He earned a PhD in CS at Ben-Gurion University and prior degrees at Hebrew University.
The method rests on a physical side effect of computing. As data moves between a processor and RAM over the memory bus, rapid shifts in voltage and current produce faint electromagnetic emissions.
RAMBO uses the x86 MOVNTI instruction, a non-temporal store, to keep the RAM bus active. The malware can then encode files, images, keylogging data, biometric information and encryption keys in software-generated radio signals.
An attacker could intercept the raw transmissions from a distance with software-defined radio hardware and a simple off-the-shelf antenna, the paper says.
The researchers describe fast modification methods that leaked data at 1000 bits per second. In the reported tests, the fast setting had a 2% to 4% bit-error rate at 3 metres.
At a slower rate, the researchers reported error-free reception up to 7 metres at 100 bits per second in their tested setup.
The paper models a 128-bit password taking about 0.128 seconds in the fast setting and 1.28 seconds in the slow setting. It puts transmission of a 4,096-bit RSA key at about 4.1 seconds in the fast setting and about 42 seconds in the slow setting.
The transmitting code used in the reported tests could run without root or administrator privileges. That means malware with fewer privileges could extract secrets once it was already installed on the machine.
RAMBO is part of a broader body of research showing that malware within an air-gapped network can send data through sound, heat, light or electromagnetic signals.
The paper proposes countermeasures for this out-of-band air-gap threat, though the material provided does not specify what they are.
Physical separation nevertheless remains central to official guidance for vital systems. On 28 July 2026, CISA, the Australian Signals Directorate, the FBI and international partners published CI Fortify, guidance telling critical infrastructure operators to prepare to isolate their most vital operational technology systems from every other network.
CI Fortify ranks physical isolation as the most effective protection for vital operational technology systems.
Comments (0)