What RAMBO actually is
The paper is titled RAMBO: Leaking Secrets from Air-Gap Computers by Spelling Covert Radio Signals from Computer RAM. The researchers' name expands to "Radiation of Air-gapped Memory Bus for Offense." The attack uses the electrical activity of the memory bus, which carries data between the CPU and RAM.
That bus is constantly moving data, and the resulting electrical signals create electromagnetic interference. RAMBO's malware controls that activity deliberately so the emissions carry a message.
Some of the coverage gets the publication timeline wrong. This is not a brand-new paper. It appeared in the proceedings of the 28th Nordic Conference on Secure IT Systems (NordSec 2023). The official NordSec 2023 program lists Guri presenting it on 16 November 2023, in the 16:00–16:30 slot. The arXiv preprint (2409.02292) was posted on 3 September 2024, and the wider press picked it up at that point. Any "newly accepted" framing in 2026 is stale.
How the covert channel works
An air gap means a machine is kept off wired and wireless networks, with USB controlled. That blocks ordinary network paths. It does nothing about physical side channels on a machine that is already compromised.
The paper's design has these parts:
- Transmitter: Software repeatedly performs memory operations, including the MOVNTI non-temporal store instruction, to generate bus activity at chosen moments.
- Modulation: The paper uses on-off keying. Memory-generated carrier activity stands for one binary state, and its absence stands for the other.
- Synchronization: The signal starts with an alternating 10101010 preamble so the receiver can lock on.
- Encoding: For faster rates the researchers use Manchester encoding. It helps with synchronization and error detection, but it doubles the required bandwidth compared with plain binary.
- Receiver: An SDR and antenna capture the raw signal. A demodulator and decoder then turn it back into bits. The data is not readable by an arbitrary nearby device.
The emissions appear at the memory clock frequency, its harmonics and other frequencies. The paper's example is DDR4-3200, which has a 1.6 GHz clock. Emissions may show up around 1.6, 3.2 and 4.8 GHz. Some systems use spread-spectrum clocking, which spreads emissions out and may make them harder to pick up.
The numbers: headline rate versus real range
The headline figure is 1,000 bits per second. The paper's detailed results show that this rate comes with trade-offs.
Test setup:
- Three workstations, each with an Intel Core i7 at 3.6 GHz and 16 GB of RAM running at 2.133–2.400 GHz, on 64-bit Ubuntu 18.04.6 LTS.
- Receiver: an Ettus B210 USRP, which covers 70 MHz to 6 GHz. It fed a NUC running a C demodulator, with MATLAB used for signal processing.
- This was a Linux lab setup. The paper does not claim identical results on every machine or RAM configuration, and it does not test Windows.
Bit timing, range and errors:
| Bit timing | Max distance maintained | Bit-error rate noted |
|---|---|---|
| 10 ms | 700 cm | 0% at listed distances up to 700 cm |
| 5 ms | 450 cm | about 3–4% at that distance |
| 1 ms | 300 cm | about 2–4% at that distance |
Faster is worse. The paper also tried 5,000 bits per second and above, and the bit-error rate was mostly above 5%. Its conclusion describes the practical channel as operating at hundreds of bits per second.
Signal-to-noise ratio fell steadily with distance. It was 38 dB at 50 cm, 30 dB at 100 cm, 22 dB at 300 cm, 15 dB at 500 cm and 8 dB at 700 cm. Other coverage of the research reports interception from up to 7 meters. That is the best-case lab figure. It is not a guaranteed operational range.
What can actually be leaked
At these speeds the channel is better suited to small, high-value secrets than to bulk copying. The paper's own estimates, at its 10 ms / 5 ms / 1 ms timings, are:
- A 128-bit password: 1.28 / 0.64 / 0.128 seconds.
- A 4,096-bit RSA key: about 42 / 20 / 4 seconds.
- 10,000 bits of biometric data: 100 / 50 / 10 seconds.
- A small 25,000-bit JPG: 250 / 125 / 25 seconds.
- A 40,000-bit text document: 400 / 200 / 40 seconds.
- Keylogging: effectively real time at 16 bits per key.
These are the paper's calculations, not field observations. They show why a private key or credential is the realistic target, and a large file share is not.
Virtual machines are not a hiding place
The researchers also ran the transmitter inside a VMware Workstation 16.2.4 guest, with Ubuntu 18.04.6 on both host and guest. They report a bit-error rate below 1% in that test. They warn that heavy host workloads, or memory activity in another guest, can interrupt signal generation. For admins who rely on virtualization in secure enclaves, the point is that a VM does not necessarily contain this kind of leak.
What this does and doesn't mean for your environment
The conditions matter. The attack model assumes malware is already running on the target. The paper names removable media, insiders and compromised supply-chain components as ways it could get onto an isolated system. Those are scenarios, not reports of a real incident. Attackers also need a suitably equipped receiver within range.
For an ordinary internet-connected Windows PC, this is not a practical concern. Remote malware has easier ways to steal data. RAMBO matters for classified, industrial-control, financial-trading and other high-assurance sites that depend on isolation.
Countermeasures, and their limits
The paper lists several defenses. None of them is a simple software switch.
- Red/black zone separation and physical access control. Keep receivers and unauthorized people away from sensitive machines. This is the most basic defense.
- Host or hypervisor monitoring of memory activity. The paper cautions that operating systems generate heavy legitimate memory traffic. This approach risks high false-positive rates and runtime overhead.
- Radio-spectrum monitoring. This is external detection, and it also produces false positives.
- Internal "jamming." Randomized memory operations can disrupt the signal. They can also disrupt legitimate workloads and use up resources. Sufficiently privileged malware might bypass or stop them.
- RF jamming and Faraday enclosures. These block emissions physically but are costly to deploy and maintain. One trade publication summarized this defense as slapping a Faraday cage around the motherboards.
- Shielding. In the researchers' setup, a 1 mm copper foil arrangement effectively blocked the emissions. The paper notes that shielding effectiveness depends on material, thickness and frequency, so treat it as a lab result and not a spec for any given chassis.
The bigger picture
Guri's lab has long published covert channels from air-gapped machines, using thermal changes, ultrasound, keyboard LEDs, hard-drive noise and fan noise. The paper's own survey of prior work lists leaks through electromagnetic emission, optical signals, acoustic noise, thermal changes and physical vibrations. RAMBO adds the memory bus to that list. The lesson from all of them is the same. An air gap is one layer of a defense, and not a guarantee.
For defenders, the practical takeaways are:
- Treat malware ingress (media, insiders, supply chain) as the real prerequisite, and spend effort there first.
- Add electromagnetic emissions to the threat model for high-security rooms, including who or what can sit within a few meters of a machine.
- Weigh monitoring and shielding against their costs. The paper is open about the false positives, overhead and expense.
RAMBO is a clever and well-documented demonstration. It is not a reason to panic, but it is a good reason to reread your air-gap policy.