Air-gapped systems are computers physically isolated from external networks, such as the internet, to protect sensitive information from remote cyberattacks. This isolation is a standard security measure in high-security environments where the risk of unauthorized access via wired or wireless connections is unacceptable. However, a new research paper titled "RAMBO" demonstrates that this physical separation can be bypassed by exploiting the hardware components of the computer itself.
The RAMBO attack works by deploying malware on a compromised air-gapped computer. This malware is designed to generate radio signals directly from the computer's memory buses (RAM). By manipulating these signals, the malware can encode a wide variety of sensitive data, including files, images, keylogging data, biometric information, and encryption keys. These signals are essentially "spelled out" as covert radio transmissions originating from the internal hardware of the machine.
To intercept this information, an attacker does not need to be physically connected to the computer. Instead, they can use off-the-shelf software-defined radio (SDR) hardware and a simple antenna to capture the raw radio signals from a distance. Once captured, these signals can be decoded and translated back into the original binary information. The researchers demonstrated that this method can leak data at speeds of 1000 bits per second. While the attack presents a significant threat to air-gap security, the paper also proposes specific countermeasures to mitigate these out-of-band radio threats.
Despite the technical feasibility of the attack, practical implementation faces environmental constraints. For example, the effectiveness of the radio signals may be influenced by the computer's physical enclosure; modern designs with large windows or plastic casings may offer less protection against radiated emissions than older, full-metal cases. Furthermore, the use of a Faraday cage—a shielded enclosure that blocks electromagnetic fields—remains a primary physical defense against such out-of-band transmissions. The research highlights a growing reality where software-driven hardware exploits can bridge the gap between isolated systems and external observers.