OS X: _securityagent
Been following some leads. There are some cases where you can get a hold of SecurityAgent and pass it shell commands. Leopard has it running as its’ own UID & GID so the security problems are not very severe but there might be a chance that in Tiger it had wheel as the GID. Either way it’s a slippery fish. If I’m able to reliably reproduce the behavior on Leopard I’ll post the code. I have to wait until Monday to try it on a Tiger machine.