The reason that this involves SSH and is in no way related to the malware example you provided is, this is not malware and will never be detected as such.  Very few things can actually block this and most of those things are either too expensive, or disabled by most organizations.  Also, this is only getting worse with time.  More and companies are opening up their firewalls outbound because it makes developers feel warm and fuzzy.  No seriously, people are doing real time integration and builds, calling third party sites like github.  I can even put my script on github.  If I wanted this to persist, I could update your .bashrc or .bash_profile and start up my tunnel again in the background (as you).<p>Another reason this involves SSH is that you already have it.  I am not installing anything.  I am just dropping a key on your machine and (as you) spawning ssh and a reverse tunnel back to a VM I control.  No need for root :-)  Now I just leverage your existing multiplexed connections into your development and production environments.  Your syslog server will not log me connecting, since I am just leveraging your existing channelized SSH session.<p>This is leveraging a bad configuration that everyone has in SSH by default.  In most cases, the attacker can also leverage the commonly poorly configured sudo as well.<p>If my government would give me legal immunity, I would prove this to you by popping nearly every major company or government office in my country in three weeks or less.