Malware can show up where you least expect it. Researchers discovered a logic bomb attack in the Python Package Index (PyPI) repository, which is code repository for Python developers and part of the software supply chain. Attackers aimed to get honest software developers to include the bombs in their applications by accident.

The researchers found six malicious payloads, all uploaded by a single user. The attacker designed them to run during a package’s installation. People have collectively downloaded these payloads around 5,000 times. Some of the logic bombs were typosquats, designed to trick people into thinking they were normal programs. Their purpose: to hijack developer systems for cryptomining.

The PyPI event is complex because it combines three different kinds of attacks: logic bombs, cryptojacking and software supply chain attacks.

It serves as a reminder to all businesses and agencies to guard against all three kinds of attacks.

The threat posed by these kinds of logic bombs and the threat posed by supply chain malware attacks call for an industry-wide approach by developers, repositories and the larger world of security tools and specialists. But that’s for the longer term. In the short-term, you need to protect your group from this brand of attack.

Defusing a Logic Bomb

A logic bomb can also be called a code bomb, cyber bomb or slag code. It’s a set of instructions that execute under certain conditions, usually with malicious intent.

One challenge with logic bomb attacks is that they don’t do anything at first. You can’t find them by hunting for strange behavior while they’re dormant. Another is that they vary in form and function from one another. Avoiding known patterns helps malicious actors plant logic bombs that victims can’t easily detect.

The payload is the problem. They can do any number of things, including stealing data, deleting or corrupting data, locking systems or launching cryptomining processes.

One common type is called a time bomb, which means that the triggering condition of the malware is a date and time. Others trigger after some specific event or activity on the machine where it’s installed. Attackers can install this kind of malware on multiple systems within an organization, the many instances increasing the chance that the malicious payload will have its intended effect. The time trigger assures that the triggering of one bomb won’t tip off security professionals to the existence of the others.

Either way, it’s possible to find and destroy logic bombs before they go off.

Cracking the Code on Cryptojacking

This goes hand-in-hand with cryptojacking, the illicit hijacking of resources for cryptomining. Attackers can steal huge bandwidth and compute, energy and, in the end, financial resources as it works to solve the equations needed for mining currency. In fact, the high resource demand — the high cost of cryptomining — is exactly why attackers are stealing it with cryptomining malware.

Beyond that, crypto-malware poses a risk because its behavior is hard to predict. In addition, it’s a foot in the door for other kinds of payloads and breaches. Protecting against it should be a high priority.

How a Logic Bomb Can Hit the Supply Chain

Software supply chain attacks — when threat actors add malicious code in third-party software with the aim of compromising applications that use that software — are among the most challenging. That’s because they simply happen in trusted software from trusted sources. The infamous SolarWinds attack put supply chain attacks on the front pages of mainstream newspapers and revealed just how damaging and widespread this kind of attack can be.

How to Defend Against a Logic Bomb

The best approach to guarding against these attacks — logic bombs, cryptojacking and supply chain attacks — can be summed up (but simplified) with one phrase: Know your networks. To be more specific, make sure you’re covered in the following areas:

  • Get to know your suppliers’ security posture and practices as well and revisit the risks from suppliers frequently
  • Open-source supply chain attacks merit special attention because they’ve grown massively in the past two years
  • Use red team tests to learn how supply chain attacks could play out within your organization and figure out how to best respond
  • Blacklist mining sites, pirate software sites and other sites are likely to lead to shady downloads
  • Disable JavaScript, if feasible
  • Keep all systems up to date on security patches
  • Keep security and IT personnel up to date on current knowledge around compromised software and to take action on known issues
  • Train employees on basic digital safety awareness and practices.

More from Intelligence & Analytics

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…

What Can We Learn From Recent Cyber History?

The Center for Strategic and International Studies compiled a list of significant cyber incidents dating back to 2003. Compiling attacks on government agencies, defense and high-tech companies or economic crimes with losses of more than a million dollars, this list reveals broader trends in cybersecurity for the past two decades. And, of course, there are the headline breaches and supply chain attacks to consider. Over recent years, what lessons can we learn from our recent history — and what projections…

When Logs Are Out, Enhanced Analytics Stay In

I was talking to an analyst firm the other day. They told me that a lot of organizations purchase a security information and event management (SIEM) solution and then “place it on the shelf.” “Why would they do that?” I asked. I spent the majority of my career in hardware — enterprise hardware, cloud hardware, and just recently made the jump to security software, hence my question. “Because SIEMs are hard to use. A SIEM purchase is just a checked…

4 Most Common Cyberattack Patterns from 2022

As 2022 comes to an end, cybersecurity teams globally are taking the opportunity to reflect on the past 12 months and draw whatever conclusions and insights they can about the threat landscape. It has been a challenging year for security teams. A major conflict in Europe, a persistently remote workforce and a series of large-scale cyberattacks have all but guaranteed that 2022 was far from uneventful. In this article, we’ll round up some of the most common cyberattack patterns we…