RAMBLE: Bluetooth Low Energy from DDR5 Memory Buses

High-security networks often rely on air-gaps to help prevent unauthorized data exfiltration, but these air-gaps are an imperfect solution. Attackers can construct emitters using physical side channels, though these covert channels tend to either require some form of custom receiver in the immediate vicinity of the victim machine or operate with extreme bandwidth restrictions. With these limitations in mind, we present RAMBLE, a proof-of-concept method to transmit valid Bluetooth Low Energy (BLE) packets from a physically unmodified computer’s memory bus. While prior research has explored the feasibility of transmitting custom signals through EM side-channels, RAMBLE demonstrates the ability to exfiltrate data to existing unmodified Bluetooth receivers, and simultaneously increases the maximum bandwidth available when leveraging custom receivers. To do this, RAMBLE leverages carefully timed writes to DDR5 memory clocked at 2.4 GHz (4800 megatransfers per second), while also optimizing the addresses and values of data being written, to generate arbitrary BLE packets. Alongside other works that demonstrate covert EM side channels, RAMBLE adds further urgency to the need to manage and mitigate malicious electromagnetic emissions.