No need for root password, user privileges are fine for typical malware. On most popular systems, $HOME is mounted without noexec, and programs are not isolate

No need for root password, user privileges are fine for typical malware. On most popular systems, $HOME is mounted without noexec, and programs are not isolated from writing everywhere in $HOME. Then all the malware have to is to alias sudo to itself (or hijack it with SUDO_ASKPASS, huh) and wait. It should be noted, though, that GNU/Linux is one step ahead — when those holes will be exploited in the wild, distro builders will start putting browsers in sandboxes, enabling AppArmor/SELinux/... by default, perventing from running executables from $HOME and whatever would be required. Everything is here, just disabled for users' convenience, trading less security for more usability. Uh, in fact, the malware is already here. Just take a peek at /var/log/auth.log (or wherever you're getting sshd messages). Unless you've set up denyhosts or something alike, you'll see lots of attempts to log in with various typical usernames and passwords. And somewhere in the world, those attempts surely succeed.