Runtime logic bomb

Code Security Container Security Open Source Security

A logic bomb is a snippet of malicious code that is intentionally inserted into other software.
Logic bombs are triggered when a certain condition is met.
The code may lie dormant for a long time and remain undetected until the bomb is triggered.
When the bomb is activated, it can have devastating effects on the software, causing it to malfunction, delete data, or even grant unauthorized access to sensitive information.
The attack can also be designed to spread to other systems or cause damage to a wider network.
The malicious code is hidden within an otherwise legitimate software package.
It can be introduced at any point in the software supply chain.

Where this idea came from

Security article

Cited from a security article or vendor blog in the original YAML; not a first-party incident report.

Mitigations

M1500 Verify third-party artifacts and open-source libraries
M1501 Require SBOM from all third-party suppliers
M1502 Define trusted package managers and repositories
M1503 Implement SCA analysis

Detections

D1500 Configure monitoring of used artifacts and open-source libraries

Runtime logic bomb

Where this idea came from

Mitigations

Detections

Observed in incidents (4)

References