Researchers demonstrate a novel attack on air-gapped systems, as malware on a compromised computer can generate radio signals from its RAM, encoding sensitive information. An attacker can intercept and decode these signals using off-the-shelf hardware, enabling data leakage at high speeds.
GDPR outlines strict regulations for data handling, granting individuals rights like access and erasure. Organizations must obtain explicit consent, implement strong security measures, and report breaches promptly. Sensitive data may be stored in air-gapped networks, disconnected from the internet, to protect against cyberattacks.
Air gap isolation physically and logically separates a system from external networks to prevent unauthorized access, which involves disconnecting network cables, disabling wireless, and blocking USB connections, ensuring no external communication channels are accessible.
Recent incidents have shown that air-gapped networks are vulnerable to breaches. Malware like Stuxnet and Agent.BTZ have exploited zero-day vulnerabilities and used methods such as infected USB drives to infiltrate isolated networks, demonstrating the need for stronger security measures to protect critical infrastructure.
The research presents a new technique for exfiltrating data from air-gapped computers using radio signals generated by manipulating RAM.
Malware can modify clock frequencies to encode sensitive information, which can be received and decoded by an attacker with appropriate hardware, posing a significant threat to the security of air-gapped systems.
The RAMBO attack involves malware being introduced into an air-gapped network via USB drives or insider collusion. Once inside, the malware collects sensitive data and transmits it wirelessly using electromagnetic emissions from the RAM, which can be intercepted and decoded by a remote attacker.
The RAM bus, a critical component of computer systems, facilitates data transfer between the CPU and RAM, which comprises a data bus for carrying data, an address bus for specifying memory locations, and control lines for coordinating data transfer.
The rapid voltage changes on the data bus during data transfer generate electromagnetic interference (EMI) and radio frequency interference (RFI). The frequency and intensity of these emissions depend on the bus’s clock speed, data width, and overall architecture.
The sender generates EM emissions by modulating memory access patterns using OOK modulation, which is used for synchronization, while the MOVNTI instruction maintains RAM bus activity.
Manchester encoding is a modulation scheme used in the transmitter to ensure reliable data transmission. By representing each bit with a signal transition, it aids in clock synchronization and error detection. While this method provides benefits for covert channels like RAMBO, it also doubles the required bandwidth compared to direct binary encoding.
The evaluation of the RAMBO covert channel demonstrates its effectiveness in exfiltrating various types of data over a short distance. Despite the signal-to-noise ratio being affected by bit times, the channel can maintain reliable transmission at different speeds.
Virtualization does not significantly impact the channel’s performance, but heavy workloads on the host or guest OS can interfere with signal generation. Faraday shielding can block the channel’s emissions, but it’s expensive and impractical for widespread deployment.
The proposed paper outlines several countermeasures to mitigate the RAMBO attack, including physical separation (red-black zoning), host and hypervisor-level monitoring, external spectrum analysis, internal and external jamming, and Faraday enclosures.
%20(1).webp?w=1200&resize=1200,0&ssl=1 "Casio Suffers Cyber Attack, Hackers Gain Unauthorized Access")
