Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM (2024)
- ID
- 41847
- Status
- summarized
- Published
- 01 Nov 2026, 9:46 AM
- Fetched
- 02 Nov 2026, 8:51 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://arxiv.org/abs/2409.02292
- Source URL
- https://hnrss.org/best
Summary
- Score
- 4.0
- Created
- 02 Nov 2026, 8:52 AM
- Tags
- Audience
- developers
What happened
Mordechai Guri's arXiv paper (2409.02292, accepted at Nordic Conference on Secure IT Systems 2023) describes RAMBO, an attack where malware on a compromised air-gapped machine encodes data — files, keystrokes, encryption keys — into software-generated radio signals emitted from RAM/memory buses. An attacker with software-defined radio hardware and a simple off-the-shelf antenna can intercept and decode the signals from a distance. The paper reports data leakage rates of 1000 bits per second using fast modification methods, and proposes countermeasures.
Why it matters
Only matters if air-gap isolation is an actual security boundary you rely on — e.g. segregated key-signing machines, OT/SCADA, or secure data rooms. If you do, the 1000 bps figure means a compromised machine can exfiltrate meaningful data over hours, so air-gap alone is not sufficient and you should treat physical/RF shielding and RAM-emission controls as part of the threat model. For typical SaaS or app builders, this is not actionable.
Discussion angle
Ask who in the room actually treats air-gap as a hard security boundary, then compare the 1000 bps exfiltration rate against the practical cost of RF shielding or jamming — is the countermeasure worth it outside high-assurance environments?