Researchers have demonstrated a new attack that extracts data from air-gapped systems by modulating radio emissions from computer RAM. The method bypasses traditional network boundaries without requiring physical access to the machine.
The attack exploits electromagnetic radiation naturally emitted by RAM modules during operation. By carefully tuning a receiver, an attacker can decode the secret data being processed. This technique works on systems completely isolated from the Internet.
The core mechanism relies on the fact that RAM chips emit low-level radio waves when reading or writing data. The research team developed a method to capture and interpret these signals. They showed that specific memory access patterns create distinguishable electromagnetic signatures. An attacker positioned near the target can capture these emissions with a simple radio receiver.
The approach does not require malware or physical tampering with the hardware. It only requires proximity and the right equipment. This makes it particularly dangerous for high-security facilities that rely on air gaps for confidentiality.
The findings challenge the assumption that physical isolation guarantees security. If an attacker can position a receiver within range, the air gap offers no protection against this specific leakage channel. Organizations must now consider electromagnetic shielding or signal-jamming measures.
The implications extend beyond data centers. Any environment using air-gapped machines for sensitive work—such as defense, finance, or research labs—should reassess their physical security posture. Future defenses may include Faraday cages or active noise cancellation for RAM emissions.
Does this attack require physical access to the computer? No. The attacker only needs to be within radio range of the target system.
What kind of equipment is needed to detect the signal? A sensitive radio receiver tuned to the frequency band where RAM emissions occur.
How does this differ from traditional TEMPEST attacks? This method specifically targets RAM module emissions rather than display or keyboard signals.