Solved This seems to be a huge security flaw in Edge and MS Defender.

annaegorov

annaegorov

Level 10
Thread author
Well-known
Forum Veteran
Feb 6, 2018
478
1,387
866
USA
If you go to this site and click on phishing, follow the prompt on that page.

www.amtso.org

AMTSO Security Features Check Tools - AMTSO

Is your security software running correctly? The AMTSO Security Features Check (SFC) tools verify that your security solution is properly configured and operating as expected.
www.amtso.org www.amtso.org

You should not be able to see the page, it should be blocked.

BUT Edge does not block it, neither does defender, Bitdefender does... Why is this allowed?
 
  • Like
Reactions: Dave Russo
I have not tested any thing else except the above, oh and Comodo also allows the page to be visible, even with tight settings. Edge and Defender same.
 
  • Like
Reactions: Dave Russo
Edge and MS Defender do not block the AMTSO phishing test because the test is not considered to be a legitimate threat. I don't believe they block the EICAR malicious web page test either, for the same reason. Bitdefender AV's and the Malwarebytes Browser Guard extension will block all of the AMTSO tests though. I don't know if Avast or AVG blocks them.

C.H.
 
  • Like
  • +Reputation
  • Applause
Reactions: Divine_Barakah, Dave Russo, lokamoka820 and 1 other person
1783983562471.png
1783983621101.png

Not blocked with either Edge nor Brave, with MD
 
  • Like
Reactions: Andy Ful, Dave Russo and lokamoka820
Captain Holly said:
Edge and MS Defender do not block the AMTSO phishing test because the test is not considered to be a legitimate threat. I don't believe they block the EICAR malicious web page test either, for the same reason. Bitdefender AV's and the Malwarebytes Browser Guard extension will block all of the AMTSO tests though. I don't know if Avast or AVG blocks them.

C.H.
Click to expand...
Was blocked only by McAfee web adivsor and Symantec browser protection extensions.
 
  • Like
Reactions: lokamoka820
annaegorov said:
thanks guys, just couldn't figure out why some did and some didn't
Click to expand...
This is because Microsoft Defender lacks web protection features to actively block phishing attacks, whereas Bitdefender includes such capabilities. Consequently, it is recommended to use a browser security extension like Bitdefender Traffic Light or Malwarebytes Browser Guard if you rely on Microsoft Defender as your primary antivirus software.
 
  • Like
Reactions: Jonny Quest, Dave Russo, Andy Ful and 1 other person
lokamoka820 said:
This is because Microsoft Defender lacks web protection features to actively block phishing attacks, whereas Bitdefender includes such capabilities. Consequently, it is recommended to use a browser security extension like Bitdefender Traffic Light or Malwarebytes Browser Guard if you rely on Microsoft Defender as your primary antivirus software.
Click to expand...
well I tried those extensions and it still didn't block it. Not sure why.
 
  • Like
Reactions: Dave Russo
Parkinsond said:
Not blocked with either Edge nor Brave, with MD
Click to expand...

Yes, my mistake, I tested the EICAR downloads. The reason for not blocking this page probably follows from this information:
"This page does NOT contain any malicious content nor does it try to phish details, but by an industry wide agreement this page is detected as a page to be blocked so that people can verify if their anti-malware product’s detection capability is configured correctly."

As it was already mentioned, MD in default settings does not include web protection, so it cannot block this phishing test.
However, it is possible to enable MD Network Protection. But it also does not block the EICAR phishing test.
It seems that instead of using EICAR, MD and Edge recommend their own testing websites:
For MD Network Protection: Network Protection - Microsoft Defender Testground
For Edge: UrlRep - Microsoft Defender Testground
 
Last edited:
  • +Reputation
  • Like
  • Applause
Reactions: Jonny Quest, Divine_Barakah, lokamoka820 and 3 others
Andy Ful said:
There is no reason to block this page. Furthermore, all tests from this page are blocked by Edge or MD.
Click to expand...
OK Now I don't have your knowledge, so I am not argueing with you.

BUT Ai said, and I paraphrase, from memory, which is very risky, that everyone has an agreement, that these pages will be flaged, and not allowed, thus they can be used for testing.

I am not sure who Ai means, when saying "everyone" I just assumed it meant ANYONE in the security community, including vendors like McAfee, Kaspersky, MWBAMW, Microsoft ECT.
 
  • Like
Reactions: Divine_Barakah
annaegorov said:
OK Now I don't have your knowledge, so I am not argueing with you.

BUT Ai said, and I paraphrase, from memory, which is very risky, that everyone has an agreement, that these pages will be flaged, and not allowed, thus they can be used for testing.

I am not sure who Ai means, when saying "everyone" I just assumed it meant ANYONE in the security community, including vendors like McAfee, Kaspersky, MWBAMW, Microsoft ECT.
Click to expand...
You can view those vendors in the members tab in AMTSO website.

www.amtso.org

Members - AMTSO

AMTSO Members AMTSO is a member-driven organization. Our diverse global community of members directs and supports all of AMTSO’s activities through their generous contributions of time, effort, and expertise. Our tester members are a core part of everything we do, and are given special status...
www.amtso.org www.amtso.org

Ironically, MS is a member
 
Last edited:
  • Like
Reactions: Jonny Quest
Microsoft Edge is clearly inconsistent in blocking all EICAR tests from the OP except for the phishing test.
Anyway, the postulate from the OP ( "This seems to be a huge security flaw in Edge and MS Defender") is untrue, especially when Microsoft has its own testground website:
 
  • +Reputation
  • Hundred Points
  • Like
Reactions: Gandalf_The_Grey, Divine_Barakah, Parkinsond and 1 other person
Andy Ful said:
Microsoft Edge is clearly inconsistent in blocking all EICAR tests from the OP except for the phishing test.
Anyway, the postulate from the OP ( "This seems to be a huge security flaw in Edge and MS Defender") is untrue, especially when Microsoft has its own testground website:
Click to expand...
To a normal user, seeing that their security product failed the test will make them panic especially with AMTSO displayed msg.

But tbh I don't know how on earth a normal user would know about AMTSO tests in the 1sr place hahahhaha
 
  • Like
  • Applause
Reactions: Parkinsond and Andy Ful

You may also like...