Question Download Sentinel a browser extension for Chrome which warns for risky downloads

Web Extensions
33 Replies 3,208 Views
Help answer the author's question with clear explanations and useful steps.
Thread details
Extension store page
https://github.com/Kees1958/DownloadSentinel/blob/main/DownloadSentinel.zip
https://chromewebstore.google.com/detail/download-sentinel/ofjlbohlnaihneapmmnhkbllbekdofce
LinuxFan58 said:
Brave only allows users to enable standard mode of Safe Browsing. I wondered whether I could add some download protection (inspired by API Void Browser Protection) which could close the gap between the new privacy conscious STANDARD mode and the ADVANCED mode (with some privacy issues).

I liked the idea of API Void Browser Protection, but wanted to help the user by checking the download-URL reputation at Virus Total and calculate a risk score based on the information available at VT to make an informed decision to either cancel & go back (block) or ignore & proceed (allow).

I uploaded the javascript module which calculates the risk score and this is what ChatGPT assessed when comparing Google Safe Browsing advanced mode against new standard mode, adding a secure DNS (like Quad9 or ControlD) and my extension. I also asked ChatGPT to compare this extension with a user who carefully checks all downloads at Virus Total and only downloads from reputable sources using onlu Google Safe Browsing in standard mode.

View attachment 298255

Warning with risk score and option to block or allow the download.
View attachment 298251

When to use this?

1. When you use advanced Google Safe Browsing ==> skip it
2. When you use API VOID Browsing Protection ==> skip it
3, When you use Safari or Firefox ==> forget it, only available on Chromium browsers
4, When you are a careful user who only uses STANDARD mode for privacy reasons and checks downloads manually ==> this extension automates it for you!

So I don´t expect it to get many users when it is available in the Chrome webstore, only people who are security and privacy aware and are to lazy to manually check stuff at Virus Total, like me :-) (for privacy reasons I only check the download URL, not the content of the download itself). Chat awards the extension a little higher (96-98) than a careful user (94-96), because the download is always paused and checked, while a careful user could forget or omit it occasionally.
Click to expand...

I wonder how AI can assess the percentage of trusted sources?
A trusted source today could be compromised tomorrow.
Take Notepad++ recently, and CCleaner in 2017, for example.

I assume it’s best to run a test**** to see if it performs better than the API Void Browsing Protection during downloads.
I assume Download Sentinel is better......
When your extension is available on CWS, if you don’t do it, I’ll do it myself.

Have a good evening.


P.S.

****= URLhaus | Checking your browser

Nothing bad can happen in Linux when you download .exe files for testing purposes.
 
Download Sentinel in the CWS:

Download Sentinel - Chrome Web Store

P.S.

It seems to me that the notification opens in a new browser window and then the download pop-up appears,is that right?
I don't like using new windows in the browser I'm using,is it possible to change this setting?:unsure:
TH.

I confirm that the extension does not affect the speed of the Speedometer 3.1 test. (y)
 
Last edited:
I decided not to compare it with API Void Browser Protection for obvious reasons.....:rolleyes:
There is a partial block on malicious GitHub files that prevents me from deleting my rules in uBo:

Test:

hxxps://urlhaus.abuse.ch/browse.php?search=github

hxxps://urlhaus.abuse.ch/browse.php?search=raw
 
Last edited:
Sampei.Nihira said:
I wish you all the best in your work.
Congratulations.(y);)
Click to expand...
Succes (y)in version 1.1 (1.0 already published on Chrome Store, but wating for the improved 1.1 to be published)

I am now always using a secondary risk scoring method (besides VT resulrts) and show it in new info box called HOST REPUTATION DETAILS when it triggers one of the following (alternate) checks: :cool:
  • Check whether the download domain of the download URL is on the Quad9 blackist
  • Check the domain age of the domain of the download URL at RDAP.org
  • Check whether the domain hosting the download is often used to spread malware
  • Check whether the Top Level Domain of the download URL is listed as a ¨much abused Top level Domain¨
  • Check whether the download URL is sketchy (e.g. includes punycode, well knwon brands or used numbers for characters (e.g 1 for l and 0 for 0)


1782065094658.png


When NoVirusThanks published API Void Browser Protection, I thought why have not thought any AV-vendors of this before, In my enthousiasme, I installed API Void Browser Protection on my wife's laptop she asked me (when API Void Browser Protection showed a block) "hey what should I do with this warning?", so I decided to use simular (not the same) heuristics to calculate a risk score. To refrain from any accusations that I used their extension, I used another block mechanism. I understand why NoVirusThanks choose another mechanism, because the mechanisme I used has it problems. I solved two edge cases in version 1.1 Now version 1.1. is offered for review. When it is available I wll post it on MT.

I re-connected to my former neighbour (who was an IT-security professional) and asked him to help fine tune the scoring model. He was satisfied with version 1.1 so when it is published I will post a new thread to explain (meaning this extensions offers simular protection as NoVirusThanks Browser Protection, it only adds some background checks (VT, Quad9, RDAO) to apply the rules of thumb of my neighbour to give it an risk rating.

So the downside of using a totally different mechanism than Api Void Browser Protection is that I have to do extra checks and balances in edge use cases. The upside is that this mechanism does not impact the Speedometer 3.1 benchmark.
 
Last edited:
@Sampei.Nihira

Two reasons I made it a new window
1. Then the extension also needs tabs access, which is considered (like All URL's host) a broad permission.
2. API Void Browser Protection is using broad permissions and DNR rules, this one minimal permission and download trigger mechanism to clearly separate them as two different extensions.

When you click on the extensions icon (the puzzle piece icon), you will see that Browser Sentinel does not need access
1782089543422.png
 
I made a rookie mistake at Google development dashboard.

I kept updating the version 1.1 now I reached my maximum submits and have to wait probably longer before 1.1 is published
1782110800562.png


Some new cool features
1. Also executable mime-types are checked and a test is added to check whether the file type is consistent with mime-type (e.g. the url shows a txt file format, while it is an executable mime-type).
2. Also checks whether the download file size exceeds Virus Total maximum (many antivirus don´t check extremely large files)

I now completed the list of indicators used as rules of thumb by my former neighbor (who is an IT security specialist) (y)

1782111397772.png
 
Last edited:

Recently browsing

Members who viewed this thread in the last 5 minutes

You may also like...

Back
Top