Weakness · Medium
CWE-511: Logic/Time Bomb
What it is
The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.
- Severity (our rating)
- Medium
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
When the time bomb or logic bomb is detonated, it may perform a denial of service such as crashing the system, deleting critical data, or degrading system response time. This bomb might be placed within either a replicating or non-replicating Trojan horse.
What an attacker can do
- Varies by Context (Other, Integrity)
- Alter Execution Logic (Other, Integrity)
How to prevent it
Installation
- Always verify the integrity of the product that is being installed.
How to find it
- Automated Static Analysis. Conduct a code coverage analysis using live testing, then closely inspect any code that is not covered.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.