New Report | When Trust is Hacked: Customer Identity Security in Finance in 2024 | A Logic Bomb is a piece of often-malicious code that is intentionally inserted into software. It is activated upon the host network only when certain conditions are met.
Logic bombs execute their functions, or launch their payload, once a certain condition is met such as upon the termination of an employee. This makes their presence undetected until it executes their function, which can range from inflicting harm through files deletion to self-propagation to the unusual, in the case of a 2019 attack by a software vendor. The perpetrator was a contractor for Siemens Corporation who placed a logic bomb into software that required it to fail at intervals to elicit service calls, for which he was paid time and again.
Roger Duronio, a UBS sysadmin, served 8 years, 1 month and ordered to pay $3.1 million in restitution to the bank. Duronio had deployed a logic bomb against the financial institution's network, damaging it, however since his 2006 scheme involved devaluing the company's stock, a kind of securities fraud, his sentence was was lengthy for a computer crime.
Logic bombs can also take effect on the target system upon a certain date — e.g. 2000, Y2K — and these are termed time bombs.
Example:
“Some disgruntled developers have a way of ‘going out screaming’ when they leave or are terminated from a work setting. They insert logic bombs into company systems that, upon certain events or at certain times, execute malicious functions such as files deletions.”
