Running untrusted software as a new user is a good start, but it may not be enough.
A lot of files and devices you may consider sensitive are world-readable. Even as an unprivileged user, you can extract a lot of information out of a system (typically you can read /etc for a start).
You may not have your own stuff configured properly. For instance, have you made absolutely sure that this "super-secret-passwords.txt" file is not readable by everyone? And what about this buggy piece of old software running as yourself or root - are you sure it's not writing anything sensitive to disk?
Code running as nobody can go on the internet and download tasks, execute code on your system.
Sometimes a socket on your local system (a unix domain socket) used for inter process communication may not be secured properly (sometimes for good reason), and any process can read and write on it.
Practically, there are things you can do.
You can absolutely check that the program doesn't start anything at boot time. It'll be tedious and you need to understand your system really well though. There are lots of ways a service can be started automatically. (Note: if the program ever ran as root, all bets are off since it could have modified the init system to hide itself)
Top tips for running terrible software
- Don't run it.
If you can avoid it at all, don't run anything you can't trust. At least make sure you are making a sound trade-off. Complexity is the enemy of security. The only line of code that's guaranteed to be secure is the line you never run. :)
- Run the program in a virtual machine.
Setting up VMs is pretty easy (VirtualBox is great if you don't want to set up any virtualisation infrastructure). This means you'll have a machine that contains no sensitive data (you'd need to have put it there) and you can control the resources it uses. This doesn't give you complete protection of course (It could do things like flood your web server with requests, log in to your lightbulbs via telnet, and so on, plus bugs that let malicious software escape a virtual machines are not very common, but they do happen sometimes).
- Run the program in a container.
Containers (LXD, Docker) offer some security for running code on your local machine. They are not perfect. But an unprivileged container provides file system isolation for your program, which is something. Securing containers properly is an art and a science, but it's getting rapidly easier.
- Have someone else run the program for you.
This is only slightly relevant to your question, but you can sometimes avoid running old, terrible software, or software that is just complex and difficult to secure properly, by using a third party service. Email is a good example of this. I would not trust myself to have the patience and spare time to host and maintain my own email server. It's a lot of work to keep things like this secure.
- Run it as a separate user.
As a last resort, and if you feel the trade-off is worth it, run the program with a new user account specially created for that purpose. I do this with software I trust.
Option 1 is the best. :)
General advice
- Your OS is fairly secure. Not completely secure of course, but Ubuntu has a reasonably good track record. Other software you install on it may not be so good. So, run your software on lots of separated, isolated machines. This will ensure that a bug in one program doesn't mean that another program, potentially more sensitive, becomes exploitable.
- Go to the web. Today, most end user software has good alternatives that are on the web. On my machine, I pretty much run Chrome and Emacs, and that's it. Using web services has it's own security implications of course.
- Go to the cloud (for server software). Are you sure you need to run your own email server? Web server? Database? Go to the cloud and let someone else do all of that tedious security stuff for you.
