IMHO "pretty much" understates the risk.
Malware can easily install itself as a system service, timer unit, XDG autostart or your shell profile among other places. I'll be the first to admit I never check all these places regularly.
The only thing that should be putting minds at ease is regular OS installs from fresh images.
Resist the temptation to do an "in place" upgrade and go with a clean ISO each time your distro comes out with a new major version.
It's a pain but thanks to configuration management or even shell scripts it's manageable for me now.
Admittedly six months is probably too long as well but at least it stops something lurking on a server or my desktop for years.
This is why things like the Nintendo Switch hacks and iphone jailbreaks have to be reloaded every time the system reboots, while they could modify the system files to try to persist the malicious code, it would simply leave the device unbootable since the boot chain attestation process would refuse to boot when the checksum doesn't match. The malware can only come back when the initial bug has been triggered again, through receiving a malicious text message attachment for example.
Why is it this particular form of 'malware protection' always seems to involve a 30% fee?
Mobile platforms just got a clean slate to implement a new security model.
It is possible even plausible that you can disinfect many sorts of malware from inside a compromised machine but it is inherently less trustworthy and installing from scratch barely takes any more time.
It’s borderline impossible to persist malware across reboots on iOS these days.
This does not account for supply chain attacks nor trojan attacks which seek consensual installation. A reboot will not eradicate these threat vectors.
What we have seen is state funded hacking groups can often exploit bugs which break out of sandboxes and embed themselves in the system. But the malicious code only exists in memory, it can’t persist between reboots because the next boot would fail the checksum and signature checks.
Which is why security focused OSs will periodically reboot themselves to flush out possible malware and why jailbreaks and hacks for phones and game consoles usually have to be reinitiated after every boot.
MacOS has a few measures including SIP and boot chain security to implement this, though it’s currently hard to set up a properly secure Linux desktop.
And organizations rely on their employees not falling for phishing email. How well has that worked?
> What we have seen is state funded hacking groups can often exploit bugs which break out of sandboxes and embed themselves in the system. But the malicious code only exists in memory, it can’t persist between reboots because the next boot would fail the checksum and signature checks.
"Malicious code existing only in memory" is patently false by not addressing supply chain attacks previously mentioned. To wit, the npm left-pad attack[0]. See also the thousands of PHP CVEs.