Is it safe to rely on network connection icons at the notification area?

Is it safe to rely on network connection icons at the notification area?

• Is it possible for malicious software to hide the real notification icons, putting fake icons that indicate there is no data data transmission occuring when in fact there is data transmission occuring at that time? What sort of APIs could be called or software tools could be used that at a low level, below the common malware infections, show the true state of a network connection? Sometimes I don't know if I can trust even the network card LEDs.

• Answer:

  The most fail-safe method of determining actual network communication status is to use a packet inspector on a second computer connected to the same network. Using a tool such as Wireshark you can filter all communications for the IP address of the suspect machine, and then view, in real time, or by log analysis, what sort of communication is occuring at any given time. Because this setup involves a second machine, it would be nearly impossible to conceal the actual network communication of the suspect machine. A bigger question you ought to ask, though, is why would anybody hack your computer? If indeed there is a malicious tool on your computer communicating over the network interface and using various methods to conceal that communication, it is much more likely you've simply got some sort of spam bot or worm software that was installed, not by hackers, but through more pedestrian and common forms of malware infection: opening the wrong file, downloading the wrong file, visiting a site on an infected server, etc.