Running Programs

An account can be secure while an unwanted program is still running on its computer. In this section, you will investigate the programs themselves. Lumen has added new computers and a checkout service; the account protections you set earlier are still in place.

A running program is called a process. Start by listing the processes. Here is a separate practice computer:

seclab inspect processes

Look for these lines:

demo-browser:
demo-helper:

Use a name from that list to read one record:

seclab inspect processes demo-helper

You should see:

demo-helper:
  Machine: practice-laptop
  User: maya
  File: demo-helper
  Parent process: demo-browser
  Running: yes
  Command: /opt/lumen/demo-helper

The record tells you where the program runs and which file it uses. A name alone does not tell you whether it is safe. Compare it with the connection records:

seclab inspect connections demo-upload

You should see:

demo-upload:
  Source: practice-laptop
  Destination: parcel-cache
  Port: 443
  Process: demo-helper
  Credential: -
  Group: -
  Ip: -
  Allowed: yes
  Reason: allowed
  Rule: 1

This connection names demo-helper as its process. Record a finding with a question name followed by your answer:

seclab answer process demo-helper

You should see:

Recorded your answer to process.

This saves the finding. It does not stop the program.