TechKnowSurge

VideoSecurityFree

Logic Bomb

A logic bomb is a malicious payload embedded in malware that remains dormant until a specific condition or trigger is met, at which point it executes its destructive function. This delay allows the malware to propagate widely before the attack is detected.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A logic bomb is a malicious construct embedded within malware that deliberately delays execution until a specific condition is met. This dormancy period is intentional, giving the malware, whether a virus, worm, or other variant, time to propagate across as many systems as possible before the attack begins. Immediate execution would quickly draw attention, prompt a defensive response, and limit the overall damage, so the logic bomb serves as a strategic delay mechanism. The trigger that activates a logic bomb can take several forms. Time-based triggers are common, causing the payload to execute on a predetermined date and time after the malware has had sufficient opportunity to spread. Alternatively, the malware may periodically communicate with a remote server, polling for a signal that instructs it to proceed. Once that condition is satisfied, the logic bomb activates and carries out its intended function, such as deleting large volumes of data, corrupting files, or launching further stages of an attack. Understanding how logic bombs operate is essential for building detection strategies that identify suspicious dormant code before it has the chance to execute.

What you'll learn

Explain how a logic bomb functions within malware, including the role of trigger conditions in delaying malicious payload execution

What's covered

Logic Bombs

Purpose & Concept
- Delay detection
- Allow malware to propagate
- Launch attack at key moment
How It Works
- Inserted into malware
- Activated by specific condition
- Executes malicious function
Trigger Types
- Time-based trigger
  - Specific date and time
- Remote website check
  - Polls for go signal
Payload Example
- Deletes files

Key terms

Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Logic Bomb: Malicious code that remains dormant until a specific condition or trigger is met, at which point it executes its harmful function.
Payload: The actual data content of a packet or message, excluding headers and metadata.
Worm: Self-replicating malware that spreads across networks without requiring user interaction.

Topics

Logic Bomb Malware Threat Analysis Cybersecurity Payload Execution Malware Behavior

Transcript

There are times when we don't want to let our presence be known until a key moment, and so maybe we do something like a logic bomb. A logic bomb is something that goes off when certain parameters are met.

The thing is, we could create a malware that spreads like crazy and spreads all around, but if it triggers something right away, then what will happen is that somebody will notice it, create a solution to get rid of it, and then our attack is done. So maybe what we want to do is stall things a little bit. We want to stall while this virus or malware, or let's say it's a worm, while this worm has a chance to propagate all around, so that way it gets all over before we launch our attack, before, in this case, the bomb goes off.

The logic and the bomb

So we have some sort of malware that we incorporate a logic bomb into. Well, what is a logic bomb? The bomb is the part where it goes off and then triggers something, and maybe this is going to delete a bunch of data. The logic part of this is that there is a trigger. So it's inserted into our malware, and it is activated when a specific condition is met.

The condition might be that it's time bound, and on this date at this time, that's when it starts deleting files, after it gets this chance to propagate. But it could be other triggers. For instance, it could reach out and just check a website to say, hey, is it time yet? Hey, is it time yet? Hey, is it time yet? And then that website would say, yes, it's time, thumbs up, go. At that point in time, then it launches and does its thing. So it executes then that malicious function that it has.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →