Can rootkits hide their internet usage from resource-manager and third party software in windows 10? If so, how?

Question

Lets say I have the latest windows 10 version. I also have DU meter for checking my network usage

I know that in windows there is a linked list of processes that many rootkits tend to remove themselves from to hide from the task manager. I'm not sure if this is still possible in Windows 10, or even if it is possible, will it make third party software not show the internet usage or not.

So I have two questions:

1. What are the methods that can be used to remove the internet usage from third party software and resource managers on Windows 10?

2. Is there anyway I can be sure that when there is no upload showing in my DU meter and resource manager then it means that there is actually no upload happening?

Answer 1

The resource manager or third party monitoring tools are software running on the computer. They could have vulnerabilities which a knowledgeable attacker could exploit with a malware in order to manipulate their output.

Besides malware acting on the computer it is possible that an attacker modified the source code of the monitoring tool or replaced its executable file in the repository and you installed already modified malicious software that will not report certain network activity.

So, it is impossible to guarantee that the numbers reported by resource manager or a monitoring tool are correct.

It is very likely that they are correct, providing that:

• Your system is up to date,
• You have an anti-virus software running,
• You installed the monitoring tool from a trusted source (and verified its digital signature or a checksum posted on its Web site)

Is there anyway I can be sure that when there is no upload showing in my DU meter and resource manager then it means that there is actually no upload happening?

Monitoring network activity by another device outside of your computer (a router, a proxy server, etc) could give you better assurance that the monitoring information is correct.

Answer 2

Since you are asking about rootkits, I will answer your question in the term of rootkits. There are several other methods.

First very little basics. There are 2 types of rootkits. User mode rootkits, which are designed to run in the user mode. The user mode is the the space in which a normal program (like Word or Firefox) is run on Windows. This space has restricted access rights. Than there are kernel mode rootkits, which are running in kernel mode. Kernel mode has the highest rights and there you can write anywhere. For example drivers are running in kernel mode. Hence it's harder to run a kernel mode rootkit, since you have to install it as driver.

User mode rootkits try to access every process and manipulate API calls that return the data the rootkit wants to hide. This is done by hooking, in user mode rootkits as well as in kernel mode rootkits. The problem here is, that you can't do this to every process, but most processes (f.e. Taskmanager, Explorer) run in user mode. So the rootkit usually can access all processes needed.

Kernel mode rootkits are similar, but they are in the kernel mode. This enables the rootkit to manipulate nearly anything.

Now your questions: 1. Yes, you just need to know the API the application is calling. 2. Not a hundred percent. It's like being sure that you are not infected by malware.