The ps command in UNIX returns a list of all of the commands that are currently running, as well as some information about them. Strangely, the command executes as root. This allows anyone connected to your machine via SSH see anything you are doing in the Terminal. For example, if I run ps -wao "user command" right now, it returns:
USER COMMAND root login -pf ryang ryang -tcsh (tcsh) ryang ftp ftp://user:pass@127.0.0.1 root login -pf ryang ryang -tcsh (tcsh) root ps -wao user commandAs you can see, it returns information about an FTP connection, including the username and password I used with it.
Mac OS X Hints
http://hints.macworld.com/article.php?story=20030418125128301