Malware Can Spell Secrets Out of Air-Gapped PCs Using Radio Signals from RAM
Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM
Researchers at Ben-Gurion University demonstrate RAMBO, an attack that lets malware on an air-gapped computer encode stolen data — files, keystrokes, biometrics, encryption keys — as radio signals emitted from the memory bus. An attacker with a software-defined radio and an ordinary antenna can pick up the transmissions from a distance and decode them back into binary, at rates up to 1000 bits per second. The paper also proposes countermeasures.
We show that malware on a compromised computer can generate radio signals from memory buses (RAM).
- talon8635
These and other methods are good reason to believe that AI can never be 100% contained, which gives me pause.
The famous air gap case is stuxnet, but there are other technical and biological approaches.
It’s a very weird reality we’ve found ourselves in if you stop, zoom out about, and really take in the gravity of the issues we are grappling with as a human race. Exciting, truly, and a bit nerve wracking.
- andai
Does any information leak along the power line? I remember having some device back in the day that let me create a LAN through my apartment's electric wiring.
I'm wondering if anything ends up back there thru the PSU during normal use of a computer, or if the high frequency components get filtered out.
(Though maybe secure computers do things differently with the power as well?)
- Grimeton
There are tons of ways to make air gappped systems transmit data. They all include the installation of some malware and have become more expensive and less usable over time.
Back in the day with crt screens you could just capture the frequencies transmitted when creating the picture and look at the copy straight away.
No malware. No direct contact. And it worked over rather big distances.
- TGower
Cool paper even if the attack isn't practical, requiring getting the malware on the computer and a SDR antenna within 7 meters with clear line of sight of the affected computer for 100 bits per second (less after applying error correction). Hard to imagine a scenario where you can pull off both of those, but you couldn't plug in a USB, grab the PC, or record the screen directly.
- WalterBright
Devices like routers should have firmware in memory that has read-only access. The access should be turned on or off by a physical switch.
This way, if malware gets installed on your router, doing a cold boot will eliminate it. You can have a timer to just cold boot it regularly.
I've suggested this many times. The rationale for not doing it is so the firmware can be remotely updated. Well, that's exactly how malware infects it.