Intentional delayed sabotage of a computer program with activation subject to conditions
A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. For example, a programmer may hide a piece of code that starts deleting files (such as a salary database trigger), should they ever be terminated from the company.
Software that is inherently malicious, such as viruses and worms, often contain logic bombs that execute a certain payload at a pre-defined time or when some other condition is met. This technique can be used by a virus or worm to gain momentum and spread before being noticed. Some viruses attack their host systems on specific dates, such as Friday the 13th or April Fools' Day. Trojans and other computer viruses that activate on certain dates are often called "time bombs".
To be considered a logic bomb, the payload should be unwanted and unknown to the user of the software. As an example, trial programs with code that disables certain functionality after a set time are not normally regarded as logic bombs.
Successful
In June 2006 Roger Duronio, a system administrator for UBS, was charged with using a logic bomb to damage the company's computer network, and with securities fraud for his failed plan to drive down the company's stock with activation of the logic bomb.[1][2] Duronio was later convicted and sentenced to 8 years and 1 month in prison, as well as a $3.1 million restitution to UBS.[3]
On 20 March 2013, in an attack launched against South Korea, a logic bomb struck machines and "wiped the hard drives and master boot records of at least three banks and two media companies simultaneously."[4][5]Symantec reported that the malware also contained a component that was capable of wiping Linux machines.[6][7]
On 19 July 2019, David Tinley, a contract employee, pleaded guilty for programming logic bombs within the software he created for Siemens Corporation.[8] The software was intentionally made to malfunction after a certain amount of time, requiring the company to hire him to fix it for a fee. The logic bombs went undetected for two years, but were then discovered while he was out of town and had to hand over the administrative password to his software.[9]
In 2023, researchers discovered that some Newag trains were secretly programmed to deliberately break down after a certain distance, or during maintenance windows, or when onboard GPS confirmed they were located in rivals' workshops for repair.[10][11]
Attempted
In February 2000, Tony Xiaotong Yu, indicted before a grand jury, was accused of planting a logic bomb during his employment as a programmer and securities trader at Deutsche Morgan Grenfell. The bomb, planted in 1996, had a trigger date of 20 July 2000, but was discovered by other programmers in the company. Removing and cleaning up after the bomb allegedly took several months.[12]
On 2 October 2003 Yung-Hsun Lin, also known as Andy Lin, changed code on a server at Medco Health Solutions Inc.'s Fair Lawn, New Jersey headquarters, where he was employed as a Unix administrator, creating a logic bomb set to go off on his birthday in 2004. It failed to work due to a programming error, so Lin corrected the error and reset it to go off on his next birthday, but it was discovered and disabled by a Medco computer systems administrator a few months before the trigger date. Lin pleaded guilty and was sentenced to 30 months in jail in a federal prison in addition to $81,200 in restitution. The charges held a maximum sentence of 10 years and a fine of US$250,000.[13][14]
On 29 October 2008 a logic bomb was discovered at American mortgage giant Fannie Mae. The bomb was planted by Rajendrasinh Babubhai Makwana, an IT contractor who worked at Fannie Mae's Urbana, Maryland facility. The bomb was set to activate on 31 January 2009 and could have wiped all of Fannie Mae's 4000 servers. Makwana had been terminated around 1:00p.m. on 24 October 2008 and managed to plant the bomb before his network access was revoked. Makwana was indicted in a Maryland court on 27 January 2009 for unauthorized computer access,[15][16] convicted on 4 October 2010, and sentenced to 41 months in prison on 17 December 2010.[17]
In October 2009, Douglas Duchak was terminated from his job as data analyst at the Colorado Springs Operations Center (CSOC) of the U.S. Transportation Security Administration. Surveillance cameras captured images of Duchak entering the facility after hours and loading a logic bomb onto a CSOC server that stored data from the U.S. Marshals. In January 2011, Duchak was sentenced to two years in prison, $60,587 in fines, and three years on probation.[18] At his sentencing, Duchak tearfully apologized as his lawyer noted that at the time of the incident, Duchak's wife was pregnant with their second child. The judge at the sentencing mentioned that this logic bomb planting "incident was an anomaly in an otherwise untarnished work history."[19]
In "Moffett's Ghost", an episode of the Airwolftelevision series, Hawke loses control of the onboard computer, which was programmed on a timer by Airwolf's creator, Doctor Charles Henry Moffett. Once activated, Airwolf is set to destroy any aircraft in its range.
In Michael Crichton's book Jurassic Park, computer technician Dennis Nedry inserted an object into the mainframe coding for the park that would shut off the entire island's power (including the supply to the electric fences) in order to steal several dinosaur embryos in the chaos. The logic bomb object was named "White Rabbit".
In the episode "Scattered" of the 2004 re-imagining of Battlestar Galactica, the Cylons leave a logic bomb in the ship's computers after briefly gaining access to them. It later causes a series of nearly catastrophic system malfunctions.
In the CIA level of Tom Clancy's Splinter Cell, a PC and console video game, a conversation can be heard with a reference to a logic bomb.
In Season 3 of 24, Nina Myers manipulates Jack Bauer to unknowingly activate a virus in the CTU computer systems. It is activated by a phone call to a certain number.
In Season 6, Episode 8 of Spooks, the Yalta organization sets off a logic bomb planted within the American defense network to shut down all US controlled satellites. It is activated by the entry of a code into a game which causes the logic bomb to copy a virus to all the satellites and shut them down.
In Series 6, Episode 2 of NCIS, Abby and McGee have a conversation about logic that gives them the idea of using a logic bomb to hack into computers on a US Naval Carrier to access certain files. No details of the bomb itself are seen on screen or discussed at all.
In Season 9, Episode 12 of Criminal Minds ("The Black Queen"), a logic bomb is used against the team that begins deleting information with failed attempts to crack the code.
In Season 2, Episode 5 of Mr. Robot ("eps2.3_logic-b0mb.hc"), Elliot discusses the use of a logic bomb to hack FBI agents' Android phones and E Corp's network and applications.
In the series The Illuminae Files, Kady Grant, Byron Zhang, and AIDAN write a logic bomb to send to the onboard computer of the Lincoln.
In the video game Tom Clancy's Rainbow Six Siege, character Dokkaebi is capable of deploying a logic bomb that can override enemy phones and provoke distraction.
In the "Autofac" episode of Electric Dreams, a logic bomb is the weapon that is used in an attempt to take down the organization that seems to be run solely by autonomous drones and robots and restricts human activities in a post-apocalyptic world.
In the 2022 film The Batman, a thumb drive inserted into Detective Gordon's laptop triggers a logic bomb that emails incriminating evidence to various Gotham City newspapers from Gordon's email address.
