What is a logic bomb?
A logic bomb is malicious code hidden inside a script, program or scheduled job that does nothing until a specific condition is met, then runs its payload. The condition might be a date and time, the presence or absence of an event, or a change in the system. A logic bomb triggered by a date is sometimes called a time bomb. It does not spread and does not announce itself; it waits, which is what makes it hard to catch before it fires.
Common triggers and payloads
Typical triggers include:
- A specific date, such as the end of a quarter or the anniversary of an event
- A user account, often the planter's own, being disabled or removed from the directory
- A missing check-in, such as code that fires if a certain person has not signed in for 30 days
- A record appearing in or disappearing from a database
Payloads are usually destructive: deleting records, corrupting files or backups, disabling systems or locking out administrators.
Why logic bombs are an insider threat
Logic bombs are most often planted by insiders, typically a disgruntled or departing employee or contractor with administrative or developer access. The pattern is consistent: someone with legitimate access adds code that will cause damage after they leave or if they are fired. Because the planter was allowed to be there, there is often no break-in, no exploit and no malware signature to detect. The code was checked in, scheduled or copied to a server by someone authorized to do so.
A logic bomb example
A systems administrator learns he is likely to be laid off. Before his last day, he changes a nightly maintenance job so that, if his own account no longer exists in the directory, it deletes the customer database and its local backups. Two weeks after his account is removed, the job runs and the data is gone. There was no intrusion, only an insider's change that nobody reviewed.
How to prevent and detect logic bombs
- Separation of duties and least privilege, so no single administrator can change production systems without oversight.
- Code review and change management, so a second person sees scripts and jobs before they reach production.
- File integrity monitoring to flag new or altered scripts, scheduled tasks and binaries.
- Disciplined offboarding: revoke access at termination and audit recent changes the person made.
- Offline or immutable backups, so a destructive payload cannot reach every copy of the data.
Logic bomb vs. trojan vs. ransomware
A trojan is defined by its disguise as wanted software and is installed by a user who was fooled. A logic bomb is defined by its trigger and is usually planted by someone with legitimate access. Ransomware encrypts data for payment and announces itself with a ransom note, while a logic bomb usually destroys data with no demand at all.
Logic bomb on the CompTIA Security+ exam
Logic bombs are one of the malware types in SY0-801 objective 2.5. Scenario wording that points to one describes dormant code that runs when a condition is met, such as a date passing or an account being deleted, especially after an angry or terminated administrator leaves. The insider angle separates it from distractors such as trojan, worm, virus and ransomware. For prevention questions, look for separation of duties, code review, change management and prompt offboarding rather than antivirus.