RAMBO: research shows how to turn RAM into a radio antenna to leak data from air-gapped PCs

What RAMBO is

RAMBO is the name of a data exfiltration technique described in the paper "RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM," by researcher Mordechai Guri, published on arXiv on September 3, 2024 (link to the paper). The work had already been accepted earlier at the 2023 Nordic Conference on Secure IT Systems (NordSec), which means the technique has been circulating in the security academic community for more than two years.

The targets are air-gapped computers: machines deliberately disconnected from any network, wired or wireless, precisely to prevent the remote leakage of sensitive data. This kind of isolation is common in environments such as military networks, industrial control systems (ICS/SCADA), research labs, and secure vaults for critical infrastructure.

Malware on a compromised computer can generate radio signals from memory buses (RAM).

Mordechai Guri, author of the research, in the paper published on arXiv

How the attack works in practice

The core idea is to exploit a physical effect: read and write operations in RAM generate electromagnetic emissions as a byproduct of the hardware's operation. Normally, this is just noise with no use to an attacker.

The paper shows that malicious software installed on the isolated machine can deliberately control the memory access pattern to shape this noise into a readable radio signal. In other words: the malware "spells out" the stolen data by manipulating RAM as if it were an improvised transmitter.

On the outside, all it takes is a software-defined radio (SDR) receiver and a simple, off-the-shelf antenna to pick up the signal from a distance, with no cable or physical connection to the target. The paper describes the process of decoding this signal back into binary information.

What can leak, and at what speed

According to the paper, the technique can encode and transmit files, images, keystroke logs (keylogging), biometric data, and encryption keys. The reported transmission rate is up to 1000 bits per second in the fastest version of the technique.

To put this number into practical perspective: at 1000 bps, leaking a 256-bit AES key would take less than a second; a file of just 1 KB (8,192 bits) would take about 8 seconds. This calculation is derived directly from the rate reported in the paper; it is not a test performed by this publication.

This makes clear the kind of target where this attack is most dangerous: it's not an efficient way to copy an entire disk, but it is fast enough to steal credentials, tokens, API keys, or other high-value point-in-time secrets, the kind of data that tends to be kept on isolated machines precisely because of its sensitivity.

Not an isolated case in air-gap research

Mordechai Guri is a recurring name in this specific field of security: over the past few years he has published a series of side-channel exfiltration techniques for isolated systems, exploring everything from fans (Fansmitter) to LEDs, speakers, and electromagnetic signals from other components, with names like AirHopper and BitWhisper. RAMBO fits into this line of research, specifically using the memory bus as the transmission medium.

The fact that the technique is already more than two years old since its original conference publication doesn't make it irrelevant: on the contrary, research of this kind tends to mature slowly within security agencies, shielding standards (such as those in the TEMPEST family), and minimum physical distance policies for sensitive equipment, precisely because it involves changes to hardware or policy, not just a software patch.

What changes for those who build and operate isolated infrastructure

For those who develop or manage systems designed to be air-gapped (payment environments, industrial automation networks, critical infrastructure, or labs with sensitive data), RAMBO reinforces a point that escapes the traditional security checklist: network isolation is not the same as complete physical isolation.

In short: keeping a machine without a network cable and without Wi-Fi doesn't eliminate the risk of exfiltration if an attacker has already managed to run malicious code on it, whether via an infected USB drive, an insider, or a compromised supply chain. The malware's entry vector remains the most basic and most important security problem.

The full paper describes specific countermeasures against RAMBO, but this general class of electromagnetic emission attack is usually mitigated with practices already known in the security literature: electromagnetic shielding of rooms and cabinets (TEMPEST standard), a controlled minimum distance between sensitive equipment and public areas, and monitoring for anomalous radio emissions at the physical perimeter of the facility.

What remains open

Guri's paper is an academic proof of concept, not a publicly documented account of real-world exploitation. The source makes no mention of a concrete case of malicious use of RAMBO outside the lab, nor does it give details on which specific RAM models or CPU architectures were tested beyond what is in the full PDF of the paper.

For security teams evaluating air-gapped environments, the natural path is to read the full paper (available in full text and in experimental HTML on arXiv) to understand the signal's capture range and the exact test scenarios, before deciding on the level of investment in physical shielding for each installation.