1

Consider me the average Linux user. I know the basics of shell scripting and intermediate Python. However, I have very limited knowledge of system admin or security related matters.

Background:

Say that I have a Python application just in the form of a cloned github repo. I simply run a .py file to start a python 3 tk-inter application. The application does not require a connection to operate, but does use quite an extensive amount of other libraries.

Further, say that I am paranoid that the application could be sharing files (or other information, but focus on files) from my system remotely. Thus I have done what I can to manually check the source code for suspicious code and scanned the repo with ClamAV.

Questions:

  1. Would this even be possible for an application to do undetected (assuming that I am not completely oblivious to whats happening on my system)?
  2. How would I easiest and/or best detect it? e.g. could I perhaps monitor the internet traffic of certain processes to see if it's transferring, or something else?

I am on Ubuntu 22.04 and the application runs in an Python 3.10 venv.

If these questions are better suited for askubuntu, or elsewhere, please let me know and I'll remove it. Also, apologies if it's too vague or if it seems trivial; I'd be happy to edit it; let me know what's missing. Also unsure about the tags.

1
  • Welcome to the community. You apparently would need to run in a sandbox and run tshark/tcpdump but this doesn't exclude logic bombs, so to be sure you would need to deeply inspect the code.. Jan 10 at 19:52

2 Answers 2

0

I haven't tested the software yet, but Opensnitch looks promising. It is an application firewall with a GUI that should let you know when applications attempt to make connections.

You could also set up a container (Docker) for the application in question, so that it will be isolated from your host machine. And you can use Docker volumes to share and persist data between the container and the host. This is actually a common setup in microservice architecture.

You'll find plenty of examples of Docker compose files if you look Python + Docker. Even an application that is not malicious in any way may be bundled with libraries that have vulnerabilities, or have fallen victim to a supply chain attack. Then isolating untrusted third-party software perfectly makes sense.

If you know that the application does not require a connection, then you can even set up a restricted namespace with no network interfaces (other than loopback).

1
  • Opensnitch does look interesting. Amazingly (I know), I've never used Docker =), using environments like conda has always been sufficient. I will look into it. I assume it's fairly straight forward to just disable all connections for the entire container then? My current lo-tech workaround has been to keep the app in an encfs volume and just simply physically disconnect my computer whenever I mount it.
    – ciru_4011
    Feb 16 at 10:38
1

Would this even be possible for an application to do undetected (assuming that I am not completely oblivious to whats happening on my system)?

Depends on what you do to detect it. If you don't do anything, there's nothing that will by default notify you of file access or network access by a Python program.

How would I easiest and/or best detect it? e.g. could I perhaps monitor the internet traffic of certain processes to see if it's transferring, or something else?

That's difficult. The best is probably to sandbox it using e.g. AppArmor to restrict what it can do. Attempted violations will be logged.

1
  • I guess I will look into AppArmor, Opensnitch, and keeping the application in a restricted Docker container. Both you and @Kate taken together essentially answered my questions; you gave the cleanest to 1 and best answered 2 and was more detailed, so I'll accept that one. Thank you!
    – ciru_4011
    Feb 16 at 10:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .