Thanks, that does entirely clear it up for me: I was missing the obvious (in hindsight): Under normal circumstances: $ bash -c 'echo date' date With this

Thanks, that does entirely clear it up for me: I was missing the obvious (in hindsight): Under normal circumstances: $ bash -c 'echo date' date With this attack, it is not going to print out the actual date, but is actually executing something like date > echo: So what happens then as you and others demonstrated: $ export X="() { (a)=>\\" $ bash -c 'echo date' bash: X: line 1: syntax error near unexpected token `=' bash: X: line 1: `' bash: error importing function definition for `X' $ cat echo Wed Sep 24 22:38:19 EDT 2014 "echo" is now a file in my current working dir. Definitely fishy business. .. the whole flip flop of echo date to date > echo so easy to miss