Venus OS on rPi phoning home

Modifications
, ,
1

Odd category and tag, but here goes… My home IP got tagged as abusive (haven’t determined the cause) which prompted me to start watching network traffic more closely, and found that my RPi running Venus OS is sending https traffic to several AWS hosts. I have VRM disabled, so I’m confused about what’s going on with that. Trying to debug that was frustrating because the BusyBox version of netstat doesn’t have the -p flag enabled, so I haven’t been able to figure out which process is involved. The other thing I noticed was a bunch of DNS queries to some .biz domain.

Suggestions?

Thx, Chris

2

You can install “lsof” via opkg, that also shows processes and open files and connections.

3

So… I couldn’t find lsof from the package manager, so built from source. From netstat, I can see amazonaws connections in TIME_WAIT. The process is gone, so lsof isn’t helping so far. I think it’s a race to find when the actual connection is open and getting the lsof data at that time.