As far as I know malware is very uncommon in Linux systems, because majority of important commands require root access. So my question is, can malware just wait until I enter sudo mode (for example by doing sudo apt-get update) and then execute malicious commands in that timeframe while sudo mode is active, without user's knowledge?

  • 1
    Once malware is running on your computer, it's no longer your computer, it's the attacker's computer. (Exception: if the attacker is stupid, an antivirus might be able to remove the malware. But you can't rely on the attacker being stupid. Antivirus software only keeps stupid attackers out, which makes it pretty much useless.) – Gilles 'SO- stop being evil' Aug 6 '14 at 23:10
  • So define 'running' on my computer. Let's say I accidentally download malware, but it cannot do anything because it does not have root access, is it right? That's the main reason why linux systems are mostly absent of malware as far as I understand. – user1880405 Aug 7 '14 at 15:40
  • 1
    If you download malware and don't execute it, there's no problem. If you execute malware on your account, then obviously it can do everything you can do: log everything you type, use all the network access that you have, etc. Root access isn't that useful for most malware; mainly, root access allows malware to hide its track a lot better. – Gilles 'SO- stop being evil' Aug 8 '14 at 8:50

No. Sudo is not a mode of the computer. Sudo executes the specified command with root privilege. Malware can only get in if you use sudo to execute the malware or if the apt-get executable has been compromised. Of course apt-get is protected and requires root privilege to modify.

Notice that if you bring up two terminals and enter sudo su to operate in the shell as root, commands entered in the other window do not have privilege.

  • 5
    Nonsense. If the user account is infected by malware, that malware can piggyback on a sudo call so that what sudo is instructed to execute is not what the user instructed. The malware can also log the credentials passed to sudo so that afterwards it can call sudo surreptitiously — not that it would need to, since having had root access once is enough to plant malware running as root. @user1880405 – Gilles 'SO- stop being evil' Aug 6 '14 at 23:08


If your user account is compromised (as in someone/something else can run arbitrary commands in your name), then they can for instance modify your ~/.bashrc and add something like:

alias sudo='sudo sh -c '\''install-my-backdoor; exec "$@"'\'' sh'

so that when you run sudo apt-get update, it actually runs sudo sh -c 'install-my-backdoor; exec "$@"' sh apt-get update, that is run install-my-backdoor as root and then apt-get update.

They can also monitor what you type and get your password (which is even worse).

  • Well I am not talking about compromised user account, just if attacker/malware can run root commands while user is in sudo more. But thanks for this info. – user1880405 Aug 6 '14 at 20:49
  • 1
    @user1880405, if the attacker can run arbitrary commands as you, then they can get superuser privilege the next time you run sudo (or if you've run sudo recently from any terminal that is still active, they can run sudo again without needing your password) – Stéphane Chazelas Aug 6 '14 at 20:54
  • Makes sense, but then I wonder is it easy for an attacker to run commands as me? – user1880405 Aug 7 '14 at 15:43
  • @user1880405, generally not, they need to exploit bugs, misconfiguration, or your trust for that. But your question as worded, suggests that you had already executed the malware code. – Stéphane Chazelas Aug 7 '14 at 16:03
  • But then again even if I executed it without sudo, it most likely won't do much harm? But like you said, I guess there are many factors to consider. – user1880405 Aug 7 '14 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.