Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM

Mordechai Guri

TL;DR

It is shown that malware on a compromised computer can generate radio signals from memory buses (RAM) using software-generated radio signals, which can encode sensitive information such as files, images, keylogging, biometric information, and encryption keys.

Abstract

Air-gapped systems are physically separated from external networks, including the Internet. This isolation is achieved by keeping the air-gap computers disconnected from wired or wireless networks, preventing direct or remote communication with other devices or networks. Air-gap measures may be used in sensitive environments where security and isolation are critical to prevent private and confidential information leakage. In this paper, we present an attack allowing adversaries to leak information from air-gapped computers. We show that malware on a compromised computer can generate radio signals from memory buses (RAM). Using software-generated radio signals, malware can encode sensitive information such as files, images, keylogging, biometric information, and encryption keys. With software-defined radio (SDR) hardware, and a simple off-the-shelf antenna, an attacker can intercept transmitted raw radio signals from a distance. The signals can then be decoded and translated back into binary information. We discuss the design and implementation and present related work and evaluation results. This paper presents fast modification methods to leak data from air-gapped computers at 1000 bits per second. Finally, we propose countermeasures to mitigate this out-of-band air-gap threat.

RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM

TL;DR

It is shown that malware on a compromised computer can generate radio signals from memory buses (RAM) using software-generated radio signals, which can encode sensitive information such as files, images, keylogging, biometric information, and encryption keys.

Abstract

Air-gapped systems are physically separated from external networks, including the Internet. This isolation is achieved by keeping the air-gap computers disconnected from wired or wireless networks, preventing direct or remote communication with other devices or networks. Air-gap measures may be used in sensitive environments where security and isolation are critical to prevent private and confidential information leakage. In this paper, we present an attack allowing adversaries to leak information from air-gapped computers. We show that malware on a compromised computer can generate radio signals from memory buses (RAM). Using software-generated radio signals, malware can encode sensitive information such as files, images, keylogging, biometric information, and encryption keys. With software-defined radio (SDR) hardware, and a simple off-the-shelf antenna, an attacker can intercept transmitted raw radio signals from a distance. The signals can then be decoded and translated back into binary information. We discuss the design and implementation and present related work and evaluation results. This paper presents fast modification methods to leak data from air-gapped computers at 1000 bits per second. Finally, we propose countermeasures to mitigate this out-of-band air-gap threat.
Paper Structure (21 sections, 1 equation, 9 figures, 7 tables)

This paper contains 21 sections, 1 equation, 9 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Air-gap Isolation
  3. Air-gap Attacks
  4. The RAMBO Attack
  5. Attack Model
  6. Related Work
  7. Transmission and Reception
  8. Signal Generation
  9. Modulation
  10. Manchester Encoding
  11. Demodulation and Framing
  12. Evaluation
  13. Signal to Noise (SNR)
  14. Bitrates
  15. Data Exfiltration
  16. ...and 6 more sections

Figures (9)

  • Figure 1: Attack demonstration. An air-gap workstation processes a secret image (Optimus Prime). The RAMBO covert channel attack transmits the image via electromagnetic waves. A remote attacker intercepts the information and recovers the secret image.
  • Figure 2: The RAMBO attack signal generation with OOK modulation
  • Figure 3: The transmission with Manchester encoding
  • Figure 4: The demodulation algorithm
  • Figure 5: The signal of the word 'DATA' (0x44 0x41 0x54 0x41) in Manchester encoding (top) and OOK modulation (bottom).
  • ...and 4 more figures