Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

new test 28/12/2018

Spoiler: links

https://pastebin.com/tpwcQ512

chrome 15/20
avira 14/20
emsisoft 18/20 (4 downloaded, tested 2 times, sandboxie and browser crashed twice)
malwarebytes 16/20
norton 3/20
bitdefender 13/20
WDBP 15/20 (14 downloaded)
squidblacklist 3/20
kaspersky 16/20

 

[omidomi]

Dr.Web: 12/20

Spoiler: not detected

https://pastebin.com/3tPyqexw

 

[FALLEN]

Thanks for the test @Evjl's Rain. I've been following your tests for a long time. Norton's web filter just...

Spoiler

 

[JM Safe]

@Evjl's Rain thanks for your tests! In my 2019 config I will probably add Emsisoft Browser Security instead of Netcraft!

 

[stefanos]

Small test avast
avast online security 13/20
avast detection 6/20
not detection 1/20

 

[stefanos]

VirusTotal

 

[LDogg]

Small test avast
avast online security 13/20
avast detection 6/20
not detection 1/20
View attachment 204537

Not a massive fan of Advanced Systemcare being used, iobit product are not exactly deemed trustworthy any more

~LDogg

 

[goodjohnjr]

new test 28/12/2018

Spoiler: links

http://restlesz.su/t.exe
http://bachaosubsy.com/viewnow/readme.exe
http://ceoseguros.com/pf.exe
http://dekhsongshere.com/downloads/Profile.exe
http://diyngabvouche.ml/goor.exe
http://file.tancyo.blog.shinobi.jp/286c6011.doc
http://fix-autos.co.uk/doc/exe.exe
http://free.fundiyideas.com/Detailed_report.zip
http://images.tax861.gov.cn/bsdt/Install_Bsdt_DotNet20.exe
http://labphon15.labphon.org/modules/contextual/contextual.exe
http://ni220471-1.web02.nitrado.hosting/M2Bob%20-%20Patcher.exe
http://redcourt.net/files/public-docs/asp_net.exe
http://sangeetkhabar.com/Akt375.zip
http://sfpixs123.dothome.co.kr/123.exe
http://siggbienesraices.com/XAVJAV.exe
http://solumagrend.com/dataprotected.exe
http://tonghopgia.net/WEBSERVICES/REDIRECT/RedirectService.exe
https://finndev.net/selif/1x4vx6jd.exe
https://uploadexe.com/uploads/5c0eea9d8b1caunimat.exe
https://www.cjoint.com/doc/18_12/HLBnmzUX3Ll_SCAN-RESERVATIONS.rar

chrome 15/20
avira 14/20
emsisoft 18/20 (4 downloaded, tested 2 times, sandboxie and browser crashed twice)
malwarebytes 16/20
norton 3/20
bitdefender 13/20
WDBP 15/20 (14 downloaded)
squidblacklist 3/20
kaspersky 16/20

Wow! What an improvement by Emsisoft Browser Security, I guess that update really made a difference, and WDBP (Windows Defender Browser Protection) is still performing better.

I guess I will be replacing Bitdefender TrafficLight with Emsisoft Browser Security to go along with WDBP for now.

Is it just me or does anyone else sometimes get HTTPs security warnings / security certificate warnings / whatever sometimes, rarely, when trying to load websites when using TrafficLight? (It only happens sometimes and briefly)

Thank you for the test Evjl's Rain.

-John Jr

 

[goodjohnjr]

no, WDBP is the same as edge's smartscreen and it will never be the same. I guess due to the browser's restriction
I believe the new edge will use smartscreen only, and they will still support for chrome
chrome has many more users => improve edge detection

Thank you for answering that Evjl's Rain.

-John Jr

 

[Evjl's Rain]

test 29/12

Spoiler: links

https://pastebin.com/V5GFwTT5

chrome 22/30
avira 28/30
BDTL 19/30
comodo 3/30
emsisoft 22/30
malwarebytes 30/30
norton 6/30
WDBP 29/30

kaspersky (low web setting) 27/30

 

[stefanos]

F-Secure SAFE
27/30
1/30 BLOCKED BY GOOGLE
2 links not work

 

[stefanos]

Not a massive fan of Advanced Systemcare being used, iobit product are not exactly deemed trustworthy any more

~LDogg

All my systems for 15 years is with advanced system care. Never i had one problem realy. I know the reviews but for me is perfect :emoji_innocent:

 

[Evjl's Rain]

PUP/adware test 2/1/2019
some extensions/AVs do very well against malwares but how do they stack up against PUPs and adwares?
most of these are PUPs, some are malwares because I can't find enough links for the test
some vendors immediately show their limitations against this kind of threat, even kaspersky has trouble sometimes. BD is the worst (in the good ones). Comodo is trash as expected

Spoiler: links

malware links 2/1/2019 - Pastebin.com

chrome 13/20
avira 14/20
bitdefender 7/20
comodo 0/20
emsisoft 16/20
malwarebytes 18/20
norton 7/20
WDBP 18/20
squidblacklist 4/20

kaspersky free AV 16/20

 

[Burrito]

PUP/adware test 2/1/2019
some extensions/AVs do very well against malwares but how do they stack up against PUPs and adwares?
most of these are PUPs, some are malwares because I can't find enough links for the test
some vendors immediately show their limitations against this kind of threat, even kaspersky has trouble sometimes. BD is the worst (in the good ones). Comodo is trash as expected

Spoiler: links

malware links 2/1/2019 - Pastebin.com

chrome 13/20
avira 14/20
bitdefender 7/20
comodo 0/20
emsisoft 16/20
malwarebytes 18/20
norton 7/20
WDBP 18/20
squidblacklist 4/20

kaspersky free AV 16/20

Malwarebytes still standing tall.

WDBP looking very good..


As always, thanks @Evjl's Rain.

 

[Sunshine-boy]

Mcafee Webadvisor :
Download McAfee WebAdvisor 4.0.7.213
1 link dead
17/19
Note: the extension and App cant block the downloading process but if you tweak browser to always ask you where to save files you see the McAfee blocked the page and you will not allow the Exe to download! anyway in real world there is no such URL that end to Exe file(at least i never saw)and McAfee will protect you.

 

[TairikuOkami]

I actually hate anything, that blocks PUP, the less it blocks the better it is, in my book. Malwarebytes is the worst, blocking good soft/webpages.
What is PUP? Whatever they decide, it is. For example: Libre/Open Office break Microsoft Office documents, so I would mark it as PUP, if I could.

 

[Nightwalker]

I actually hate anything, that blocks PUP, the less it blocks the better it is, in my book. Malwarebytes is the worst, blocking good soft/webpages.
What is PUP? Whatever they decide, it is. For example: Libre/Open Office break Microsoft Office documents, so I would mark it as PUP, if I could.

You are so wrong in this post that is almost a deceptive reply.

It is obvious that the industry has guidelines for what PUP is, if it wasn't the case the vendors would have to deal with many many legal problems.

About Malwarebytes and PUPs:
PUP Reconsideration Information & Request Form

For me strong PUP detection is vital, it is the number one threat in volume now days, but for people who don't care about privacy or system performance, they can always disable PUP detection, at least while using good antivirus/anti-malware solutions.

 

[TairikuOkami]

It is obvious that the industry has guidelines for what PUP is

No, they do not, it is up to each company to choose, whatever they want. Like Malwarebytes blocking RT news, that is so PUP.
Not to mention they also block game boosters, but they forgot to block the most used one called game mode, which does exactly the same.

 

[Nightwalker]

No, they do not, it is up to each company to choose, whatever they want. Like Malwarebytes blocking RT news, that is so PUP.
Not to mention they also block game boosters, but they forgot to block the most used one called game mode, which does exactly the same.

Ofcourse they do:
PUP Reconsideration Information & Request Form
How Microsoft identifies malware and potentially unwanted applications

Almost all vendors follow those criterias.

Malwarebytes blocking RT news? You are confusing the HEURISTIC, CLICKBAIT false positive in the extension with deliberate PUP detection.

Anyway ...

 

[TairikuOkami]

How Microsoft identifies malware and potentially unwanted applications

Exactly: How Microsoft identify PUP.

PUP Reconsideration Information & Request Form

How do we (Malwarebytes) identify potentially unwanted software?

Malwarebytes blocking RT news?

They have lifted the ban after complaints, but that only proves, that they are following no guidelines, but do whatever they want to.

PUP is generally a grey area. Just like DNS blocking bad webpages, that is so wrong, because you can not access them, unless you change DNS.