Definition
A logic bomb is a piece of malicious code that hides inside a program until a specific condition is met, and then it springs into action. Most of the time everything runs normally. But once a preset moment arrives, like a certain date or a particular file being deleted, it can freeze the system or wipe out important data.
A Time Bomb That Stays Quiet Until It's Time
Picture a time bomb tucked away in the back of a closet. Until the clock hits the set time, the house is silent and life goes on as usual.
A logic bomb hidden inside a computer program works the exact same way. A disgruntled insider or an outside intruder tucks it into a corner of otherwise normal software. Until the condition is met, the destructive part never runs. And since the code is often written by someone with legitimate access, it doesn't match any known malware pattern. That's why regular security scans often fail to catch it.
The program looks perfectly safe and runs every day. So ordinary users, and even professional security admins, have a hard time spotting anything odd. The scariest part is that you may not even know the danger exists until it's too late.
Thanks to this stealth, a logic bomb can sit in a corner of a server for months or even years without causing any trouble, just waiting.
What Pulls the Trigger?
In computing, the condition that wakes up a logic bomb is called a "trigger." The most common trigger is a specific date or time. For example, an attacker might set the code to wipe a company's core database on a certain anniversary, or at midnight on a weekend.
Triggers aren't limited to time. A person's actions or a change inside the system can set one off too. A resentful employee might write a condition like "if my employee ID is removed from the HR roster." The moment they get fired, a revenge device destroys the system automatically.
Some bombs work the other way around: they go off if "a certain admin account doesn't log in every month." That turns the bomb into a kind of blackmail. Only by staying at the company and entering a password can the person keep it from exploding.
A trigger can be any condition a programmer can imagine, so it's very hard to know in advance what form it might take.
To Be More Precise: How Is It Different From Other Malware?
Many people mix up logic bombs with the kind of malicious software that travels across networks. But a logic bomb can't copy itself or go hunting for other computers to infect. That said, a virus or worm can carry this kind of conditional code along with it.
Rather than spreading over a network, it's closer to conditional code that sits quietly inside one system or piece of software and acts only when its condition is met. That's why many known cases involve insiders who know the system's structure and permissions well, rather than unfamiliar outside attackers.
Relying on a single antivirus scan isn't enough to stop logic bombs. Code review is essential: several teammates carefully check the code one person wrote.
It also helps to have strict access control, such as revoking system access right away when an employee leaves or changes departments. That cuts down the threat from the inside.
Common misconceptions
A logic bomb is a program that spreads by infecting other computers on its own.
A logic bomb can't copy itself or spread on its own. It's code planted directly inside a specific system or piece of software, and it runs only when its set condition is met. A virus can sometimes carry this kind of code, though.
Where you meet it
A developer still on the payroll secretly plants code that deletes company data if their name is ever removed from the payroll list (a hypothetical example often used in security textbooks)
A malicious script built to corrupt files on storage drives of devices around the world the moment a certain anniversary begins at midnight
In one sentence
A logic bomb is malicious code that hides quietly until a certain date or condition is met, and then wrecks the system, just like a time bomb.