Is it possible for android malware (with root privileges) to hide it's connections from network monitoring apps installed on the infected device?

Are android network monitoring apps (such as Net Monitor from f-droid) reliable?

Or it would be better to use Wireshark and similar apps to analyze network traffic?

I have an android device with android 8.1 and I cannot see anything suspicious while using the fdroid app.

  • 1
    I've never used any such app but ss or netstat or other methods described in this answer (other than VPNService) rely directly on kernel to monitor network connections (sockets or packets). So if the kernel itself is not hacked by the malware, stats reported should not be wrong. Monitoring from outside is always more reliable but it won't work for per app (UID) tracking. – Irfan Latif Mar 21 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.