guys, as talking to a friend who knows linux/unix better than i do, he was talking about someone wrote some program/code, and put in a linux workstation, and that program secretly send users data out, which leaks the user's sensitive data. I wonder if this is possible on N900? and if yes, how could we exam the OS system, and protect data on N900 better?

many thanks

There was this Linux issue at the end of last year. Basically, it was spotted and 'fixed' by the community in pretty short order. So, two tings to bear in mind. Be careful what you install and keep in touch with the rest of the community in case anything untoward is discovered.

thank rich c, i wonder if there is any way we can examine the system in N900?

rkhunter has been mentioned before on these forums but as far as I can see, it's not available to install. I guess you could virus scan your N900 if you had it mounted on a desktop machine in mass storage mode. In fact, I might try that right now.

Just plugged my N900 into my Linux lappy as mass storage & KlamAV quite happily scans the resulting mounted drive.

thanks rich c, however I wonder if this will scan the Maemo OS files?

Nope, it would just scan MyDocs (and the Memory card if there is one).
Any app can be dangerous, which is why there is -devel (not for users who don't want risks) and -testing where apps have to pass a QA list to get into extras (which is the safest repo of all three).
If someone makes an app that does that I doubt there is any way to find it by means of SW scanners.