CWE-511 is code designed to disrupt the legitimate operation of a product or its environment when a certain time passes, or when a certain logical condition is met. It applies across languages and to mobile software too.
How it happens
A time bomb waits for a date. A logic bomb waits for a condition, such as a particular account being removed or a counter reaching a number. Until then it does nothing, so tests and early use look clean.
# Illustrative pattern: dormant until a date
import datetime
if datetime.date.today() > datetime.date(2027, 1, 1):
wipe_data_directory()
MITRE notes that a bomb may be placed inside either a replicating or non-replicating Trojan horse, so it can arrive hidden in code that looks useful.
What an attacker gains
When the bomb goes off, MITRE says it may cause a denial of service. That includes crashing the system, deleting critical data or degrading response time. The listed impact is a change to execution logic, and the result varies by context.
How to find it
MITRE's detection advice is simple and practical: conduct a code coverage analysis using live testing, then closely inspect any code that is not covered. Dormant code stays dormant in tests, so the uncovered lines are where it lives.
Also search for suspicious comparisons against fixed dates, and for logic that deletes or disables things based on conditions unrelated to the feature.
How to fix it
MITRE gives one mitigation: always verify the integrity of the product that is being installed. Add these habits:
- Review code from outside contributors and new dependencies, focusing on branches that destroy or disable.
- Treat uncovered code in security or data paths as a review item, not as acceptable.
- Pin versions, so an updated package with a new hidden branch does not slip in unseen.
Quick check
Why do tests usually miss a logic bomb?
The trigger condition is rarely met during testing, so the code never runs. Coverage reports show those lines as untested.
