Executive Summary

Hear the phrase ‘Easter egg’, and we bet the first thing that pops into your head is a sweet treat. In the world of cyber security, though, an Easter egg could leave a bitter taste in your mouth. Instead of chocolate, this kind of Easter egg is a hidden feature or a piece of code left behind by developers, which in some cases could leave your network and your data exposed to malicious actors.

What are Easter eggs?

Easter eggs - at least, the coding variety - have been around since the 1970s. The creator of an Atari game, Adventure, was disappointed to learn that his name wouldn’t appear in the game’s credits. He added a hidden room to the game, with nothing in it other than the words ‘Created by Warren Robinett.’ Players soon began searching for the room, in the same way that they’d hunt for literal Easter eggs, and the name quickly stuck.

Most easter eggs are meant to be harmless jokes or messages, and can be added to anything from computers games and applications to software and websites. For example, if you go to Google and type ‘askew,’ the search results page will be tilted to the side. Or if you type ‘Do a barrel roll,’ the page will spin 360 degrees. However, others can be more on the harmful side. Inspired by Warren Robinett getting back at his bosses when he didn’t get the credit he deserved, some people have added Easter eggs as ways of sticking it to the man - or even getting revenge.

What can these Easter eggs do?

Since these kinds of Easter eggs are tucked away and kept secret, they’re not part of a program’s or software’s official final code. Any piece of undocumented code like this could prove to be dangerous. For example, if the software is updated in the future, then the Easter egg’s code won’t be. This can eventually lead to incompatibilities, and the code not working properly, and can even leave vulnerabilities for hackers and criminals to find their way into your network.

Something similar to an Easter egg is a logic bomb. Just like an Easter egg, it’s a piece of code that’s deliberately hidden away. However, the main difference is that a logic bomb is purposefully malicious. It can be activated at a specific time, or when a certain set of conditions is met, and then launch harmful processes such as malfunctions or deleting files. For example, a former employee at the mortgage loan company Fannie Mae left behind a logic bomb that would have deleted all of the data on 4,000 of the firm’s servers. Luckily it was found months before it was meant to be triggered.

How can you protect yourself?

While Easter eggs can be harmless or even fun, they’re still security risks, and should be dealt with before they can cause any damage - whether they’re designed to or not. Updating your software and installing any patches can help deal with any vulnerabilities that might already be there. You can also prevent employees from downloading and installing any unwanted applications or programs, and ensure that you know what’s on their devices.

It’s also worth checking for any unauthorised or malicious code that’s not meant to be there, and monitoring your network for any unusual activity. Whatever the size of your network, this is easier said than done, which is where Cyber Security Associates can help. We can monitor your network from our Secure Operations Centre (SOC), and give you and your business 24/7 support. Instead of wasting unnecessary amounts of time and money setting up an SOC of your own, we can take care of it, checking for any cyber threats and addressing them quickly if any incidents arise.

As well as monitoring for threats, we can also assess your network, checking for any cracks in your defences that might already be there and addressing them for you - or test your employees with realistic cyber incident exercises. To find out more about how we can help, contact us today.