The air gap is a speed bump, not a vault: RAM can whisper

Unplug the cable, switch off the Wi-Fi, lock the room: is the computer finally safe? An academic paper on an attack called RAMBO, which leaks secrets from air-gapped computers through covert radio signals, suggests the honest answer is "safer, not safe."

What the research actually shows

The work comes from Dr. Mordechai Guri, head of the Offensive Cyber Research Lab, according to The Hacker News. The idea is that malicious code on an infected, isolated machine manipulates memory operations so the memory buses emit radio signals. Those signals carry encoded data. The arXiv paper reports leaking data at 1000 bits per second.

That is slow, and we shouldn't pretend otherwise. But a password, an encryption key or a short document doesn't need broadband. The attack also isn't a way in. The malware must already be on the machine, and, as with related air-gap attacks, a receiver has to be within range. The paper doesn't remove the air gap's value. It attacks the belief that the air gap is absolute.

Isolation is a risk reduction, and that's fine

An air gap is, in the textbook definition, a machine with no network interface connected to other networks. That definition is about networks. Physics doesn't read it. Memory, cables and CPUs are electronics, and electronics radiate.

RAMBO is not a one-off, either. Related academic work covers Ethernet cables used as antennas, covert Wi-Fi signals from air-gapped computers picked up several meters away, and electromagnetic channels that a nearby insider or spy could read with a mobile phone or laptop. When the same attack family keeps producing new variants, it looks less like a curiosity and more like a category.

Our view: the right reaction is not panic and not "who cares, it needs malware first." The first infection is exactly what air-gapped environments are built to prevent, so assuming it can't happen is the weak point. Security teams should treat the air gap as one strong layer among several, not as the thing that lets them skip the others.

Who should worry, and what to do

Most readers should not lose sleep. If your threat model is ransomware or phishing, this research is far down your list. It matters for the narrow set of systems where isolation is the main control: key management, sensitive industrial or government networks, anything whose leak would be catastrophic.

For those, we'd argue for three habits. First, add physical side channels to the threat model, alongside the network and USB ones. Second, think about distance and shielding: these attacks depend on a receiver being close, so who can get close matters. Third, invest in detection. One IEEE paper builds a lab with low-cost hardware precisely because there were no publicly available datasets for detecting RAM-based radio exfiltration. That tells us defenders are behind attackers on the data they have, and that monitoring is still immature.

There is also a quieter lesson about overconfidence. "Air-gapped" is often used as a conversation-ender in audits. It should be the start of a question: gapped from what, and against whom?

Our verdict

Keep your air gaps. They remain one of the cheapest ways to remove most attackers from the picture. But stop calling them guarantees. If a system is valuable enough to isolate, it is valuable enough to ask how it could still talk to someone standing nearby with a receiver. RAMBO's answer is uncomfortable: more easily than you'd like.