🚀 go-pugleaf

Why would a hacker (who apparently has root access) need to tell users to
change their password?  On my system (Linux) all root has to do is wipe out
the users' old password and then the account is free.  You could then log in
as that user without a password and run the passwd program to change it to
whatever the cracker feels like doing.  Similarly, couldn't this also be
done to the root password as well?  This is all assuming that there is a
normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
If a user has access to the passwd file, he can change the users group Id to
0, too no?

I'm curious as to (if the above is correct) what can be done to cut down the
chances of such an attack..