Once a piece of malware has gained access to a user's account, it can:
1. Create a bash alias (in the current shell, and in
~/.bashrc) to a command which fakes the
[sudo] password for $USER: prompt, and steals the user's password.
alias sudo='echo -n "[sudo] password for $USER: " && \
read -r password && \
echo "$password" >/tmp/sudo-password'
2. Similarly, it can place an executable named
~/.bin, and modify the
PATH variable to achieve the same effect:
3. Catch key presses through the X server, watch for the word
sudo, then try the text between the next two Enter key presses as the password.
4. A similar thing can be done in any environment (the console, Wayland, X) using e.g.
5. If malware infects a shell that uses
sudo caches credentials, the malware can continouosly check if it is possible to
sudo without a password:
while : ; do
echo | sudo -S echo "test" &>/dev/null && break
sudo echo "We now have root access"
1 & 2. Use
\ ignores aliases, and
$PATH. Alternatively, add an alias such as:
ssudo="\/bin/sudo", and always use
ssudo instead of
sudo. It seems unlikely that a virus would be clever enough to remap this alias.
3. Avoid typing your password when using X11. Instead, use a virtual console, or Weston.
The only way to completely eliminate the chance of the
sudo password being sniffed, seems to be to avoid it altogether. Instead, login as root to a virtual console.
According to Alexander Peslyak: "the only safe use for su [and sudo] is to switch from a more privileged account to a less privileged one…"
On a side note, sudo does have some countermeasures:
sudo reads from
tty instead of
alias sudo='tee -a /tmp/sudo-password | sudo' breaks
sudo (but does capture the password).