Legal Definitions - logic bomb

A logic bomb is a type of malicious computer program or code that is intentionally embedded within a computer system or network. It is designed to remain hidden and inactive until a specific condition is met, at which point it automatically activates to perform an unauthorized, often destructive or disruptive, action.

The trigger condition for a logic bomb can vary widely. It might be a particular date or time, the deletion of a specific file, the failure of a user to log in, or even a change in the system's operational status.

• Example 1: Disgruntled Employee Sabotage

  A software developer, anticipating termination from their job, embeds a piece of code into the company's proprietary customer relationship management (CRM) system. This code is programmed to activate and permanently delete all customer contact records if the developer's user account is deactivated from the system. After the developer is indeed terminated and their account is disabled, the code executes, causing significant data loss for the company.

  This illustrates a logic bomb because the malicious code (deleting records) was dormant within the system, waiting for a specific condition (account deactivation) to be met before it automatically triggered its destructive function.

• Example 2: Time-Based Data Corruption

  A former IT contractor, before their contract expired, secretly inserted a script into a critical server's operating system. This script was designed to lie dormant until a specific date six months in the future. On that predetermined date, the script automatically activated, corrupting the server's configuration files and causing a widespread outage for the company's online services.

  Here, the logic bomb remained hidden and inactive until a specific future date served as its trigger, at which point it automatically executed its disruptive payload, demonstrating its time-based activation.

• Example 3: System Monitoring Evasion

  A hacker successfully breaches a company's internal network and plants a small piece of code within the network's security logging system. This code is programmed to activate and erase all security logs from the past 24 hours if the system detects an administrator attempting to access the log files from an unfamiliar IP address. This allows the hacker to cover their tracks if their unauthorized activity is discovered.

  This scenario demonstrates a logic bomb because the malicious code is designed to remain dormant until a specific system event (an administrator accessing logs from an unfamiliar IP) occurs, at which point it automatically activates to perform an action (erasing logs) intended to evade detection.