up vote 3 down vote favorite
3
share [g+] share [fb]

I noticed some strange python process trying to access IPs which seem to belong to Google, such as 74.125.77.109 (according to whois). The process has this initialization command in ps:

bash -c P=python2; $P -V 2>/dev/null || P=python; "$P" -c 'import sys; \
  skip_imports=1; verbosity=2; exec compile(sys.stdin.read(764), \
  "assembler.py", "exec")'

Any ideas what this could be?

link|improve this question
49% accept rate
3  
Does not look good from the security POV. Please do #locate assembler.py and try to open that file. – lzap May 16 '11 at 9:04
1  
Try running pstree -H the_pid_of_that_procees. It could give you better clues as to what exactly spawned that. – Mat May 16 '11 at 9:08
I have seen Google using python for internal components before, but this is a bit odd. All of the tips here are good: find assembler.py, check out the process tree, and take a look in the proc filesystem. – jcrawfordor Aug 31 '11 at 20:20
feedback

2 Answers

up vote 1 down vote

ls -l /proc/<pid> and ls -l /proc/<pid>/fd may tell you more.

link|improve this answer
feedback
up vote 0 down vote accepted

Turns out it belongs to sshuttle which was running at that time.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.