Any user process can append anything they want to your shell rc (.bashrc, .zshrc). In this case, they added a bash function for a fake sudo prompt. It then uses the password the user entered to run a malicious payload as root.

▲

silver_sun 3 hours ago | parent [-]

If you're running a malicious user process with write (or read) access to your files, you are arguably already compromised.

▲

LinXitoW 3 hours ago | parent | next [-]

The freaking point is that basically anything worth running will have that amount of access, even Flatpaks. And you don't freaking know what's malicious before hand.

	▲	silver_sun 3 hours ago \| parent [-]
		I think that depends on your point of view. I wouldn't run a program on my computer unless I were sure that it's not malicious. And if you mean that some program I already trust could be exploited, that's true even for the Linux kernel or any sandbox / security solution you would come up with. I'm not denying that there's always a risk, but there's nothing good in running arbitrary code that you can't trust.

▲

inigyou 3 hours ago | parent | prev [-]

Exactly the point. You are already fully compromised, sudo adds no security.