4

I noticed some strange python process trying to access IPs which seem to belong to Google, such as 74.125.77.109 (according to whois). The process has this initialization command in ps:

bash -c P=python2; $P -V 2>/dev/null || P=python; "$P" -c 'import sys; \
  skip_imports=1; verbosity=2; exec compile(sys.stdin.read(764), \
  "assembler.py", "exec")'

Any ideas what this could be?

Improve this question
3
  • 3
    Does not look good from the security POV. Please do #locate assembler.py and try to open that file.
    – lzap
    May 16, 2011 at 9:04
  • 1
    Try running pstree -H the_pid_of_that_procees. It could give you better clues as to what exactly spawned that.
    – Mat
    May 16, 2011 at 9:08
  • I have seen Google using python for internal components before, but this is a bit odd. All of the tips here are good: find assembler.py, check out the process tree, and take a look in the proc filesystem.
    – jcrawfordor
    Aug 31, 2011 at 20:20

2 Answers 2

Reset to default
3

Turns out it belongs to sshuttle which was running at that time.

Improve this answer
2

ls -l /proc/<pid> and ls -l /proc/<pid>/fd may tell you more.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .