Search code examples
pythonx86system-callsselect-syscall

Capturing syscalls of malicious python packages

I want to capture syscalls of malicious python packages. Is there any way to do this? Or can I capture syscalls in wireshark?

For reference: Typosquatted Python packages, much like StackOverlow copy/paste.

Solution

    1. Wireshark does not trace syscalls, it traces the network traffic, two completely different thingsnote

    2. Why are you even importing and/or installing such packages

    3. You can use strace on any */Linux distribution

      3.1. Though strace output is often hard to read, you're better off reading the src

    4. Use a virtual machine, just in case you know

    Note: Wireshark can trace USB as well as network traffic.

    This is unlikely to solve your problem as read() is a function. If it reads /etc/passwd, it is different than /etc/python/debian_config. You would have to examine the arguments to the syscall.