Detecting if application connects remotely in linux

Question

Consider me the average Linux user. I know the basics of shell scripting and intermediate Python. However, I have very limited knowledge of system admin or security related matters.

Background:

Say that I have a Python application just in the form of a cloned github repo. I simply run a .py file to start a python 3 tk-inter application. The application does not require a connection to operate, but does use quite an extensive amount of other libraries.

Further, say that I am paranoid that the application could be sharing files (or other information, but focus on files) from my system remotely. Thus I have done what I can to manually check the source code for suspicious code and scanned the repo with ClamAV.

Questions:

1. Would this even be possible for an application to do undetected (assuming that I am not completely oblivious to whats happening on my system)?
2. How would I easiest and/or best detect it? e.g. could I perhaps monitor the internet traffic of certain processes to see if it's transferring, or something else?

I am on Ubuntu 22.04 and the application runs in an Python 3.10 venv.

If these questions are better suited for askubuntu, or elsewhere, please let me know and I'll remove it. Also, apologies if it's too vague or if it seems trivial; I'd be happy to edit it; let me know what's missing. Also unsure about the tags.

Answer 1

I haven't tested the software yet, but Opensnitch looks promising. It is an application firewall with a GUI that should let you know when applications attempt to make connections.

You could also set up a container (Docker) for the application in question, so that it will be isolated from your host machine. And you can use Docker volumes to share and persist data between the container and the host. This is actually a common setup in microservice architecture.

You'll find plenty of examples of Docker compose files if you look Python + Docker. Even an application that is not malicious in any way may be bundled with libraries that have vulnerabilities, or have fallen victim to a supply chain attack. Then isolating untrusted third-party software perfectly makes sense.

If you know that the application does not require a connection, then you can even set up a restricted namespace with no network interfaces (other than loopback).

Answer 2

Would this even be possible for an application to do undetected (assuming that I am not completely oblivious to whats happening on my system)?

Depends on what you do to detect it. If you don't do anything, there's nothing that will by default notify you of file access or network access by a Python program.

How would I easiest and/or best detect it? e.g. could I perhaps monitor the internet traffic of certain processes to see if it's transferring, or something else?

That's difficult. The best is probably to sandbox it using e.g. AppArmor to restrict what it can do. Attempted violations will be logged.