Think of a prison where inmates communicate by tapping pipes. The guards sealed every door, window, and phone line — but forgot the pipes run through every wall. In RAMBO, the pipes are memory buses, and the tapping is carefully orchestrated read/write patterns that generate electromagnetic emissions in the radio frequency range. No hardware implant needed. The malware IS the transmitter. The committed claim: software running on an air-gapped computer can modulate RAM bus activity to produce radio signals encodable as binary data, receivable by a software-defined radio with a commodity antenna at useful distances. The exfiltration rate hits 1,000 bits per second — fast enough to steal encryption keys, keystrokes, and small files. This is not theoretical. The authors built it, measured it, and demonstrated it across multiple scenarios. Mordechai Guri, working out of Ben-Gurion University's Cyber Security Research Center, is effectively the world's leading practitioner of air-gap covert channel research. His prior work includes exfiltration via fan noise (Fansmitter), hard drive LEDs, power lines, screen brightness, and USB thermal emissions. RAMBO is the RAM-focused entry in this systematic catalog. The technique uses Manchester encoding on OOK-modulated signals generated by toggling memory access patterns at controlled frequencies. The SDR receiver side is off-the-shelf hardware. The architecture family here is electromagnetic side-channel exfiltration — a well-established class in hardware security research. What distinguishes RAMBO is the software-only transmitter requirement: no modified firmware, no hardware implant, no physical access after initial compromise. The method leans on the inherent physics of high-speed digital buses — current changes in RAM data lines radiate electromagnetic energy as an unavoidable byproduct of operation. The malware simply choreographs those current changes to carry information. Integrity is the complicated dimension. This is a single-team demonstration, not an independent replication. The evaluation appears to be conducted in a controlled lab environment — the authors measure signal-to-noise ratios, bit error rates, and effective range, but the threat model assumes the malware is already installed on the air-gapped machine (via supply chain, insider, or infected USB). That's a significant prerequisite that the paper acknowledges but doesn't dwell on. The benchmarks are appropriate for the claim being made, but no external team has reproduced the results independently. The 1,000 bps rate is the headline number, but context matters. That's roughly 125 bytes per second — enough to exfiltrate a 256-bit AES key in about 0.25 seconds, but a 1MB file would take over two hours. The practical threat is targeted exfiltration of high-value small secrets (keys, passwords, credentials), not bulk data theft. The countermeasures section proposes RAM jamming, zone restrictions, and Faraday shielding — all standard for high-security facilities, all expensive to retrofit. The real contribution is less the specific channel and more the systematic proof that air gaps leak through physics. Every Guri paper narrows the definition of 'isolated.' For organizations running air-gapped systems in sensitive environments — military, intelligence, critical infrastructure, financial vaults — RAMBO adds another vector to the threat model that cannot be patched in software alone. The defense is physical: shielding, distance, and operational discipline.
