New Account com.malwarebytes.mbam.nobody

[MrElvey]

I'm also curious about this user, but for a new reason.  It's the ONLY user on my system that has a passwd.  Why? 
This can be seen with 
 

defaults read /var/db/dslocal/nodes/Default/users/com.malwarebytes.mbam.nobody.plist

No other account has a non-null/"*" passwd field.
Seems back-door-y.  Why is it like this?


(Is it OK if I change the password with passwd?)

 

[edit - added by AdvancedSetup]

Reference:

https://forums.malwarebytes.com/topic/272218-new-account-commalwarebytesmbamnobody-created-on-imac/

 

Edited August 31, 2023 by AdvancedSetup
Split post to own topic

[MrElvey]

(Can also be seen in Directory Utility, though the password there is eight asterisks (length = 8, bytes = 0x2a2a2a2a2a2a2a2a), similar to the usual "*" not a string like 1339F498-A4**-45**-A4**-79E40DBFB661.)

[AdvancedSetup]

Hello @MrElvey

Please see the following link which should help explain what this account is for

https://askubuntu.com/questions/329714/what-is-the-purpose-of-the-nobody-user

 

[MrElvey]

 It confused the heck out of me that you split my question off of the old thread I asked it in. (It appeared you had deleted my comments and locked the thread!) Also, it makes this thread confusing, and doesn't notify the people active on that thread, who could well help.  Maybe?  @treed , @alvarnell ?  I wish you hadn't split my question off of the old thread.  Sometimes reviving an old thread makes sense. 

Also, your reply is not super relevant; I'm not asking about the nobody user.  That's a different user. Proof: 

% ls /var/db/dslocal/nodes/Default/users/*nobody*
/var/db/dslocal/nodes/Default/users/com.malwarebytes.mbam.nobody.plist    
/var/db/dslocal/nodes/Default/users/nobody.plist

Anyway, as noted in my follow-up comment, it seems like it doesn't have a valid password. I can also see that its shell is /usr/bin/false, which is also reassuring.  It is still odd that i's the ONLY user on my system that has a passwd - the only file in LDAP ( /var/db/dslocal/nodes/Default/users/)  with one.  Maybe it would be better if the app created it with the usual * password in future?

Edited September 1, 2023 by AdvancedSetup
Corrected font issue

[alvarnell]

I'm aware of this topic, but have nothing to offer. Staff will have to weigh in on this one.

[AdvancedSetup]

Support has sent you an email with a support ticket. Please follow up with them.

Thank you