I am thinking about this lately a lot, so I wanted to get someone else's opinion.
Let's say that I have an SSH key agent (e.g. Pageant or
ssh-agent) running in background with loaded keys (keys were, of course, passphrase-protected). What stops a malware (running as a current user) from exploiting this, connecting to a SSH host and possibly running remote commands?
I hope that my understanding of this is flawed but, as long as agent is running in background, I can issue an
ssh command and go right through the login.
Can you please help me confirm whether this is correct?
If this is in fact valid attack vector, what would be the best a way of protecting myself from it?