Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

Makes sense to test it. Looks like it did fairly well.

~LDogg

the problem is, it can only shine with tweaked settings. The default setting is useless against malwares as it never blocks anything in my test
block unrated seems to be a default-deny solution for web protection, but it slows down web browsing a lot because it suspends the page from loading and has to wait for the result from the server. It takes time

 

[LDogg]

the problem is, it can only shine with tweaked settings. The default setting is useless against malwares as it never blocks anything in my test
block unrated seems to be a default-deny solution for web protection, but it slows down web browsing a lot because it suspends the page from loading and has to wait for the result from the server. It takes time

That's could be the downside to this product then. If tweaked can be good but the page loading as you stated is slow. Overall doesn't look worthy of a subscription bit. Even forticlient free web filter seems to be a lot faster by the sound of it.

~LDogg

 

[Evjl's Rain]

That's could be the downside to this product then. If tweaked can be good but the page loading as you stated is slow. Overall doesn't look worthy of a subscription bit. Even forticlient free web filter seems to be a lot faster by the sound of it.

~LDogg

blocksi for chrome is free
other services on their website aren't free

if someone cares about default-deny, blocksi is a good extension. If they have good internet speed, they might not notice any slowdown. I'm too far from US or Europe

 

[LDogg]

blocksi for chrome is free
other services on their website aren't free

if someone cares about default-deny, blocksi is a good extension. If they have good internet speed, they might not notice any slowdown. I'm too far from US or Europe

Would that mean I could get Blocksi via Chrome Extension for opera? If so I may give it a try!

~LDogg

 

[Evjl's Rain]

Would that mean I could get Blocksi via Chrome Extension for opera? If so I may give it a try!

~LDogg

there is no official support for opera in the webstore but you can try to port it opera by
Install Chrome Extensions
if it works, it works. If it doesn't, sorry

 

[LDogg]

there is no official support for opera in the webstore but you can try to port it opera by
Install Chrome Extensions
if it works, it works. If it doesn't, sorry

You don't have to be sorry man , some extensions work via that and some don't. Just the way it is

~LDogg

 

[tsunami]

K9 site is up. is it a goner? i doubt they would update the dated software but the effectiveness is still solid.

 

[Moonhorse]

K9 site is up. is it a goner? i doubt they would update the dated software but the effectiveness is still solid.

Yes k9 is here to stay

 

[Terry Ganzi]

Test 3/9/2018
With many PUP/adware links

chrome 26
malwarebytes 23
avira 20
comodo 2
WDBP 10
blocksi block unrated 27
ublock squidblacklist 10
hphosts (full+partial) 14
IE/Edge 22 or 23 (1 warned but didn't block)

ThorRC 16
Forticlient 25
kaspersky 21

a bad show from Kaspersky (as expected, against PUPs)
I won't test Norton Safe web and DNS security.
Neustar DNS always wins

Screenshot comparing Thor RC and hphosts. Thor is left, hphosts is right. Same files are highlighted
Thor actually prevented 1 link from downloading (without any notification) because the link contacted via port 8081. It can only be downloaded with thor disabled
@Nightwalker

Most of that stuff was block by these host file in UBO that i added.

https://www.squidblacklist.org/downloads/dg-malicious.acl • https://raw.githubusercontent.com/EnergizedProtection/EnergizedHosts/master/EnergizedUnified/energized/hosts •https://raw.githubusercontent.com/EnergizedProtection/EnergizedHosts/master/EnergizedUltimate/energized/hosts •https://raw.githubusercontent.com/EnergizedProtection/EnergizedHosts/master/EnergizedMalware/energized/hosts • https://hosts-file.net/emd.txt
​

CHEF-KOCH's Malware Filter List​

​

 

[ForgottenSeer 69673]

I only clicked on a few links but the last one on the list showed a to download and I clicked cancel but about 20 seconds later Cylance quarantined it anyway, even if I chose not to download it.
The next one I clicked on was blocked with Windows smart screen, Edge. I do have the Ublock extension for Edge but don't think I have all the right filters set up for it yet. I will check out the other links later.

 

[stefanos]

there is no official support for opera in the webstore but you can try to port it opera by
Install Chrome Extensions
if it works, it works. If it doesn't, sorry

Works for me at Opera. But for blocksi no

 

[Sephiroth Source]

K9 in custom mode with four active boxes: Phishing; Spyware / Malware Sources;
Spyware Effects; Suspicious: 24

 

[upnorth]

The Blocksi domain was blocked by F-Secure but I sent a submission and it's fixed now.

 

[Evjl's Rain]

Test 6/9/2018, all from VT 60 links

a.doko.moe/izgvrd
aile.pub/newsletter/En/Invoice-Corrections-for-75/65
aktha.in/O4qS2n
aspettaprimavera.it/4LmlHpS
azathra.kmfkuii.org/oldplugins/9223896WDXZ/PAYMENT/US
barcounterstools.info/13EQ/PAYMENT/US
biciculturabcn.com/Receipts-09-18
bo2.co.id/60740SUFKAD/com/Business
clipkadeh.ir/wp-includes/xerox/EN_en/Overdue-payment
conservatoriocimarosa.gov.it/QtJJky
dev.pacificsymposium.org/UKZvz1aj
emmlallagosta.cat/DOC/En/Summit-Companies-Invoice-4045545
empire-pi.co.za/040QVJZM/com/US
enet.cm/ZGWLBkF8F
engage.tb-webdev.com/0739ITKSNY/ACH/Smallbusiness
fib.usu.ac.id/templates/files/US/Inv-87109-PO-6D135435
fidfinance.com/Receipts/
flowerella.ca/For-Check
gospelldigital.com.ng/INFO/En/Invoice-receipt
gutshaus-hugoldsdorf.de/Invoice-09-18
habarimoto24.com/667MJB/oamo/Commercial
hotellaspalmashmo.com/305102X/SWIFT/US
hps.nz/Document/EN_en/Outstanding-Invoices
hukukportal.com/default/US_us/Overdue-payment
iconnectedintelligence.com/uXHtKU
imish.ru/UKd94kPc7U/
ingridkaslik.com/payment/
kristianmarlow.com/Documents
lashedbykylie.com/Receipts
lumoura.com/0496GIIF/PAYROLL/Commercial/
masjedkong.ir/8LCEWFVLF/com/US/
mebel-m.com.ua/493A/SWIFT/Commercial
morrissan.com/57HN/BIZ/Commercial
neatappletech.readysetselfie.com/74679OE/PAYMENT/Personal
newble.com/410632UNWK/PAY/Commercial
ni3s.com/2140018T/identity/Personal
noithattdc.com/cgi-bin/539USEZUYTB/SEP/Commercial
old.gkinfotechs.com/inIDT
oliveiras.com.br/Payments-09-18/
omlinux.com/xerox/En/Past-Due-Invoices
outsourcingpros.com/n4Gi3D31d8
pardis-decor.com/Receipts/
prestashop.inksupport08.com/604EQ/SWIFT/Commercial
psp.express/XMYMS
ruirucatholicfund.org/scan/EN_en/Invoice
sabritru.com/Documents
saqibsalon.com/INVOICE
sethoresg.com.br/4215SVQW/WIRE/Business
shop.irpointcenter.com/957NTPCW/com/Business
sokam-holding.com/FILE/US_us/Invoice
stsnetworkllc.com/1716RIACO/BIZ/Commercial
tabloid.id/iKZ9NWTm4V
test.fratiterrasanta.it/70564WF/SWIFT/Personal
treesurveys.infrontdesigns.com/payment-09-18
uvurkhangai-aimag.barilga.com/4992PU/biz/Commercial
viswavsp.com/zmaxmovment.exe
vpnetcanada.com/Corrections/
webartikelbaru.web.id/1143ZHEJ/oamo/Personal
[URL='http://www.mozambiquecomputers.com/files/etna.exe']www.mozambiquecomputers.com/files/etna.exe[/URL]
[URL='http://www.truongnao.com/tyoinvur/951670HWGNEE/PAYROLL/US']www.truongnao.com/tyoinvur/951670HWGNEE/PAYROLL/US[/URL]

chrome 49/60
ublock (custom) 35/60 => all blocks were from hphosts (full + partial = EMD+PSH+HJK+...)
avira 2/60
blocksi (block unrated) 60/60
comodo 0/60
malwarebytes 39/60
WDBP 4/60
Norton 3/60
Edge/IE 19/59

Forticlient 53/60
Kaspersky 53/60
K9 (default/custom = same result) 59/60

Thor RC 18/60
hphosts 35/60
Missed item analysis:
- 19 items are identical
- 5 items are exclusive in hphosts, 24 are in Thor RC


ublock custom filters


k9 custom filters

 

[HarborFront]

Test 6/9/2018, all from VT 60 links


chrome 49/60
ublock (custom) 35/60 => all blocks were from hphosts (full + partial = EMD+PSH+HJK+...)
avira 2/60
blocksi (block unrated) 60/60
comodo 0/60
malwarebytes 39/60
WDBP 4/60
Norton 3/60
Edge/IE 19/59

Forticlient 53/60
Kaspersky 53/60
K9 (default/custom = same result) 59/60

Thor RC 18/60
hphosts 35/60
Missed item analysis:
- 19 items are identical
- 5 items are exclusive in hphosts, 24 are in Thor RC
View attachment 197107

ublock custom filters
View attachment 197106

k9 custom filters
View attachment 197108

So, from the tests it seems I can get rid of uBlock Origin or not? Can Blocksi blocks google analytics and those pesky cookie popup messages? Anything here that I needs UBO?

When I installed the Chrome extension it says

Blocksi Manager Dashboard locks-in the Filtering Policy, reports analytics and allows dynamic filtering policy changes.

So, does that mean it BLOCKS google analytics?

Thanks

 

[Evjl's Rain]

So, from the tests it seems I can get rid of uBlock Origin or not? Can Blocksi blocks google analytics? Anything here that I needs UBO?

Thanks

no you can't get rid of ublock because it's a true adblocker while blocksi or malwarebytes are not
blocksi is a domain blocker only while adblockers can block everything including domains, urls, hide elements,...
I don't know if blocksi can block analytics but it it can, it will be limited compared to true adblockers
even ghostery, disconnect are not comparable to ublock/adguard with sufficient number of filters at analytic blocking

never uninstall an adblocker because they are unique and useful

 

[HarborFront]

no you can't get rid of ublock because it's a true adblocker while blocksi or malwarebytes are not
blocksi is a domain blocker only while adblockers can block everything including domains, urls, hide elements,...
I don't know if blocksi can block analytics but it it can, it will be limited compared to true adblockers
even ghostery, disconnect are not comparable to ublock/adguard with sufficient number of filters at analytic blocking

never uninstall an adblocker because they are unique and useful

I have revised my earlier post. Can re-comment?

I just visted wilderssecurity.com and Blocksi blocks it saying

URL : wilderssecurity.com
Category : Unrated

So, Blocksi does blocks URLs

However, if I type hxxps://wilderssecurity.com Blocksi allows it

Thanks

 

[Azure]

So, from the tests it seems I can get rid of uBlock Origin or not? Can Blocksi blocks google analytics and those pesky cookie popup messages? Anything here that I needs UBO?

When I installed the Chrome extension it says

Blocksi Manager Dashboard locks-in the Filtering Policy, reports analytics and allows dynamic filtering policy changes.

So, does that mean it BLOCKS google analytics?

Thanks

Or you can enable advance mode in uBlock. And use its dynamic filtering.

 

[Evjl's Rain]

I have revised my earlier post. Can re-comment?

I just visted wilderssecurity.com and Blocksi blocks it saying

URL : wilderssecurity.com
Category : Unrated

So, Blocksi does blocks URLs

However, if I type hxxps://wilderssecurity.com Blocksi allows it

Thanks

I read your previous comment but I don't have a proper answer because I'm not familiar with blocksi. I'm sure that blocksi won't be great against ad/tracker
I don't like blocksi to be honest. I test it because some people are interested in it
wilderssecurity.com or www.wilderssecurity.com is a domain

https://www.wilderssecurity.com/find-new/4975955/posts

is an url (full)
blocksi doesn't block full url as it only blocks domain

for example, example.com/malware.exe is a full url. blocksi blocks example.com as a blacklisted domain
ublock can either block example.com or example.com/malware.exe specifically if there is rule for it

however, some malwares are distributed via githab, gitlab, email services or some reputable hosts => blocksi will be useless in this case because blocksi should not/cannot block github, gitlab,... domains because everyone uses them
adblocker or malware blocking extensions are more flexible as they can block specific urls such as

https://raw.githubusercontent.com/malwareexample.exe

NOTE: all the links I posted above are not clickable, they are just examples

 

[Moonhorse]

@Evjl's Rain norton extension is the new one you used? If yes, it seems they just made it worse

Norton Safe Web