TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A research paper posted to arXiv in September 2024 describes a method for malware on a compromised air-gapped computer to encode data in radio signals generated by its memory buses. The authors report a rate of up to 1,000 bits per second and describe interception using software-defined radio equipment and an antenna; the paper was accepted to a 2023 security conference.
A research paper posted on arXiv on September 3, 2024, describes how malware on a compromised, air-gapped computer could encode data in radio signals generated by its memory buses. The authors report a transmission rate of 1,000 bits per second and say an attacker could capture the signals with software-defined radio equipment and an antenna, illustrating a way information might leave a computer without a conventional network connection.
The paper, titled “Leaking Secrets from Air-Gap Computers by Spelling Radio Signals from RAM,” presents a method the researchers call a software-generated radio signal channel. According to the abstract, malware modifies activity associated with the computer’s memory buses to produce emissions that can be encoded to carry information. A receiver can capture the radio signal and decode it into binary data.
The authors say the technique could be used to transmit a range of information, including files, images, keystrokes, biometric information and encryption keys. Those examples describe possible data types in the paper; they do not establish that every category was transmitted in every test. The abstract reports a rate of 1,000 bits per second, but does not specify in the supplied material the test conditions, transmission distance, error rate or the exact performance for each type of data.
The researchers describe receiving the emissions with software-defined radio hardware and an off-the-shelf antenna. Their paper also discusses implementation, evaluation and countermeasures. The work is listed on arXiv as a paper accepted to the Nordic Conference on Secure IT Systems in 2023; the arXiv record identifies the September 2024 posting as version one.
How the Air Gap Can Be Bypassed
Air gaps are used to isolate computers from networks, including the internet, in settings where limiting remote access is part of protecting sensitive information. The research addresses a separate risk: a compromised computer may still produce physical signals that can carry data outside the system. That makes network disconnection alone an incomplete safeguard if an attacker can first place malware on a device and position suitable receiving equipment nearby.
The result matters to security teams because it focuses attention on unintended emissions as well as wired and wireless network connections. The paper presents a research technique, not evidence that air-gapped systems generally are being exploited this way. The practical risk depends on factors such as access to the target, the receiver’s proximity and capability, the environment, and the safeguards in place.
The reported rate also puts the claimed channel in perspective. At 1,000 bits per second, the method would not be equivalent to ordinary high-speed network transfer. Still, a relatively slow channel could be relevant for selected data, depending on what is sent and how long an attacker can operate. The supplied abstract does not provide enough detail to quantify those scenarios.
Products Worth Considering
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Waterproof, Dustproof, USB‑C, Up to 12 hr Battery, Black
DJI Mic 3 Wireless Microphone Kit (2 Transmitters, 1 Receiver, Charging Case)
Anker SOLIX C1000 Gen 2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
What the 2024 Paper Describes
An air-gapped computer is kept physically separate from external networks, including wired and wireless connections. Such isolation can reduce exposure to remote attacks, but it does not by itself establish that a device is free of malware or unable to emit signals. The researchers’ proposal relies on a computer being compromised before the signal channel is used.
This paper sits within research into out-of-band communication: methods that move data through a physical effect rather than a standard network interface. In this case, the authors focus on radio emissions associated with memory-bus activity. Their abstract says malware can encode sensitive information in these signals, while receiving hardware can capture and translate them back into binary information.
The timeline is relevant to interpreting the report. The paper’s comments say it was accepted to the 2023 Nordic Conference on Secure IT Systems, while its first arXiv version was submitted on September 3, 2024. The arXiv posting is the public record cited here; the supplied material does not provide a separate conference publication date or additional independent validation.
““We show that malware on a compromised computer can generate radio signals from memory buses (RAM).””
— The paper’s authors, in the arXiv abstract
Limits of the Reported Results
The supplied source material does not establish how well the method performs across different computers, facilities or operating conditions. It also does not state the tested transmission distance, the degree of signal interference, how reliably receivers recover data, or whether the reported rate applies to all the information types listed by the authors. Those details would be needed to judge the channel’s practical limits.
The article describes a research method, not a confirmed incident involving stolen data. The abstract says the authors present evaluation results, but the material provided here does not include those results in full or identify independent replication. It is also unclear from the supplied information what specific hardware configurations or detection measures were tested.
The paper says it proposes countermeasures, but the abstract excerpt does not enumerate them. Readers should not infer that the paper establishes an easy or universal way to defeat air-gap protections: the method presupposes a compromised machine and a receiver capable of capturing and decoding its emissions.
Further Testing and Defensive Review
The next step for readers assessing the claim is to consult the paper’s full methods and evaluation, including its descriptions of the transmitter, receiver, operating conditions and countermeasures. Those details can clarify the reported data rate and the circumstances in which the method worked.
Organizations that rely on air-gapped systems can review their existing controls for malware introduction, physical access and unintended radio emissions. The paper points to countermeasures but the supplied abstract does not describe them, so specific mitigation choices should be grounded in the full research and an organization’s threat assessment rather than assumed from the headline result.
No new test, exploitation incident or follow-up milestone is identified in the provided source. The confirmed status is that the work was accepted to a 2023 conference and later posted as an arXiv paper in September 2024; further practical conclusions depend on the underlying evaluation and any subsequent independent study.
Key Questions
What does the paper claim?
The authors describe malware using radio signals generated by memory-bus activity to transmit data from a compromised air-gapped computer. A receiver could capture the signals and decode them into binary information, according to the abstract.
What data rate did the authors report?
The paper’s abstract reports 1,000 bits per second. The source material provided does not specify the test conditions, transmission distance or error rate associated with that figure.
Does this show that air-gapped computers were attacked?
No attack incident is reported in the supplied material. The paper describes a research method that assumes a computer has already been compromised; it is not evidence that the technique was used to steal data from a real system.
What equipment does the proposed receiver use?
The abstract says an attacker could use software-defined radio hardware and an off-the-shelf antenna to intercept the signals. It does not give the full equipment specifications or tested range in the material provided.
Source: arxiv.org
