Logic Bomb
A digital time bomb that lies quietly in wait until a specific date or condition sets it off.
Definition Malicious code deliberately hidden inside software that stays dormant until a specific condition is met. While it behaves normally day to day, the moment a preset trigger occurs—like a specific date arriving or a key file getting deleted—it activates to wipe data, crash systems, or cause widespread damage.
A Silent Time Bomb Hiding in Plain Sight
Imagine a time bomb hidden deep inside a closet. Until the timer hits zero, the house remains completely quiet and life goes on as normal.
A logic bomb in software works the exact same way. A disgruntled insider or an attacker sneaks malicious code into an otherwise legitimate program. Because it runs quietly alongside normal code, it easily slips past routine security checks.
Since everything seems to operate smoothly, everyday users and even seasoned security admins rarely suspect a thing. The greatest danger is that you have no idea a threat exists until the trap is sprung.
Thanks to this stealthy nature, a logic bomb can lie dormant on a company's server for months or even years, quietly waiting for its moment.
What Pulls the Trigger?
In computer science, the specific condition that wakes up a logic bomb is called a 'trigger.' The most common trigger is a preset date or time. For instance, an attacker might set it to wipe out a corporate database at midnight on a holiday weekend.
Triggers aren't limited to the clock; user actions or system changes can pull them, too. A resentful employee might program a condition like 'IF my employee ID is deleted from HR payroll.' The moment they are fired, the code acts as an automated revenge switch to crash the system.
In other cases, a bomb might detonate unless a specific administrator logs in every 30 days. The attacker forces the company to keep them employed simply to keep entering the password that disarms the trap.
Because triggers can be built out of almost any condition a programmer can imagine, spotting them in advance is exceptionally difficult.
Behind the Scenes: How It Differs from Other Malware
People often confuse logic bombs with typical viruses or worms that spread across the internet. However, a logic bomb has no ability to replicate itself or infect other machines on its own.
Rather than spreading across a network, it is a piece of conditional code secretly planted directly inside a specific system. For this reason, logic bombs are far more likely to be planted by rogue insiders with high-level access than by external hackers.
Defending against logic bombs requires more than just standard antivirus scans. Teams must practice thorough peer code reviews, where multiple engineers inspect any new code before deployment.
Organizations also need strict access control policies, immediately revoking server credentials whenever an employee resigns or switches roles, stopping insider threats before they take root.
🤔 Common misconceptions
A logic bomb is a virus that automatically spreads from computer to computer.
Logic bombs cannot self-replicate or spread on their own. They are snippets of code planted directly inside a target system that only execute when triggered.
🧺 Where you meet it
A digital time bomb disguised inside software, staying dormant until a specific condition or date triggers it to cause damage.