RAM Signals Expose Air-Gapped Networks to Attacks

A novel side-channel attack exploits radio signals emitted by random access memory in air-gapped computers, presenting a new threat to highly secure networks.

See Also: OnDemand | Protecting Devices and Software from Next-Generation Cyberthreats

Researchers from Ben-Gurion University of the Negev introduced a new technique called the RAMBO, for RAM-Based Radio Signals attack, which allows attackers to exfiltrate data from air-gapped systems using radio frequencies generated by RAM.

Air-gapped networks are physically isolated from the internet, with no wired or wireless communication channels available, making them common in sensitive environments such as military installations and critical infrastructure.

Leader researcher Mordechai Guri in newly published research demonstrated that even those environments are vulnerable to sophisticated attacks.

“Attackers can turn the very hardware inside these systems into an antenna,” Guri said. “This takes the concept of data leakage to a new level. We’re not just talking about files or passwords anymore – we’re talking about the memory of the computer itself acting as a covert communication device.”

Guri and his team developed a method to manipulate the electrical currents flowing through a computer’s memory bus, generating electromagnetic signals that could be intercepted and decoded by an attacker with the right equipment. The emissions can be modulated to represent binary data, allowing malware inside the air-gapped system to transmit sensitive information – such as encryption keys, biometric data or even entire files – to a remote receiver outside the network.

The attack is carried out in several phases, Guri said. First, the air-gapped network must be compromised, typically through physical means such as an infected USB drive or insider threat. Once malware is introduced, it infects the target machine, gaining access to the memory.

From there, the malware generates radio frequency signals by manipulating the RAM’s electrical activity. The signals can then be intercepted by an attacker using a software-defined radio receiver and a simple antenna placed within a certain range of the compromised machine.

The key innovation of the RAMBO attack is the use of RAM to produce these covert signals, a method that is difficult to detect. The RAM bus, which connects the central processing unit to memory, is constantly transferring data, generating electrical signals that generate electromagnetic interference. By carefully controlling this electrical activity, the attacker can encode data in the emitted signals.

The researchers were able to transmit data at a rate of up to 1,000 bits per second, enough to exfiltrate sensitive information relatively quickly. This is done using a modulation technique called on-off keying, where the presence or absence of a signal represents binary data.

With RAMBO, attackers no longer need to rely on traditional methods such as USB drives to extract data from air-gapped networks. As long as the target machine is running, an attacker can potentially siphon off information through the radio signals generated by its RAM.

“Imagine a scenario where sensitive government or corporate data is being exfiltrated through RAM emissions. This is no longer a hypothetical threat. It’s happening, and organizations need to prepare,” Guri said.

While the RAMBO attack poses a significant threat, Guri’s research includes potential countermeasures. One of the most effective ways to mitigate the risk is to cover sensitive machines with Faraday shielding.

This involves enclosing the computer in a metal case that blocks radio signals from escaping. Other countermeasures include restricting physical access to air-gapped machines, disabling USB ports and monitoring memory usage for suspicious activity.

“Faraday shielding can be expensive, and it’s not a practical solution for all environments. Organizations need to assess their risk and decide on the appropriate level of protection,” Guri said.