Logic/Time Bomb

Opis

The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.

When the time bomb or logic bomb is detonated, it may perform a denial of service such as crashing the system, deleting critical data, or degrading system response time. This bomb might be placed within either a replicating or non-replicating Trojan horse.

Skutki

• Other, Integrity

  Varies by Context; Alter Execution Logic

Zapobieganie

• Installation

  Always verify the integrity of the product that is being installed.

Słabość nadrzędna

• CWE-506 Embedded Malicious Code

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Mobile

Uwagi

It is suspected that malicious code can often be characterized using other "regular" weaknesses related to insecure behavior. However, this has not been closely investigated.

Źródła

1. Mobile App Top 10 List — Chris Wysopal, 2010
2. A Taxonomy of Computer Program Security Flaws, with Examples — Carl E. Landwehr, Alan R. Bull, John P. McDermott, William S. Choi, 1993