RAMBO attack steals data using RAM in air-gapped computers

[erek]

"How the RAMBO attack works​

To conduct the Rambo attack, an attacker plants malware on the air-gapped computer to collect sensitive data and prepare it for transmission. It transmits the data by manipulating memory access patterns (read/write operations on the memory bus) to generate controlled electromagnetic emissions from the device's RAM.

These emissions are essentially a byproduct of the malware rapidly switching electric signals (On-Off Keying "OOK") within the RAM, a process that isn't actively monitored by security products and cannot be flagged or stopped.

Code to perform the OOK modulation
Source: Arxiv.org
The emitted data is encoded into "1" and "0," represented in the radio signals as "on" and "off." The researchers opted for using Manchester code to enhance error detection and ensure signal synchronization, reducing the chances for incorrect interpretations at the receiver's end.

The attacker may use a relatively inexpensive Software-Defined Radio (SDR) with an antenna to intercept the modulated electromagnetic emissions and convert them back into binary information."

Source: https://www.bleepingcomputer.com/ne...teals-data-using-ram-in-air-gapped-computers/

 

[auntjemima]

These attacks are so wild. Technology is a beautiful bitch.

Air gapped is the new norton antivirus. All talk and no game.

 

[Nobu]

These attacks are so wild. Technology is a beautiful bitch.

Air gapped is the new norton antivirus. All talk and no game.

Well, getting in is the hard part, being air-gapped and all that. Simpler if you have an insider, but the risk for them is much higher.

 

[Ranulfo]

SDR's, I haven't messed with one of those in awhile. I don't even remember where I stored my couple of units. Great for basically a computerized scanner/ham radio or ADSB plane tracker with virtualradar server.

 

[Shoganai]

If malware is getting onto your air gapped computer, you're doing it wrong.

 

[emphy]

Well, getting in is the hard part, being air-gapped and all that. Simpler if you have an insider, but the risk for them is much higher.

I expect that getting the signal out is just as hard - the range of those signals can't be that great, so one's detection equipment is going to have to be placed on the selfsame, likely secured, premisses that the air-gapped system is on.

With that sort of physical access being available to the adversary, this exotic attack would probably overly complicate things for them.

 

[OutOfPhase]

I like the one which modulated the fan rate in the PC to transmit data, personally.

But yes, physical locality is anathema to security.

 

[Zarathustra[H]]

Well, getting in is the hard part, being air-gapped and all that. Simpler if you have an insider, but the risk for them is much higher.

Agreed. You have to both get the malware onto the machine AND have a sensor close enough to the affected machine to monitor the EM fluctuations.

It certainly is a wakeup call for some, but it is not exactly easy to take advantage of, especially when it comes to highly secured military type computer systems.

Air gapping is certainly better than not air gapping (if you have something that needs to be very secure) but Stuxnet should have taught us this lesson already back in 2010.

When you have a state backed effort behind something like this, almost anything is on the table, and it requires you to not rest on your laurels.

 

[auntjemima]

I like the one which modulated the fan rate in the PC to transmit data, personally.

But yes, physical locality is anathema to security.

What always amazes me is not that these malware computers but the fact that can make uninfected computers KNOW that fan speeds are data and to collect and transmit the data.