Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

K9, forticlient and Kaspersky as always prove their quality! On the other hand i can't understand the continuously falling of Norton and the downfall of Comodo web filtering as it started well.

I don't know what happens to Symantec. Norton Safe Web failed even in vxvault/malc0de tests (usually it did well) and now extracted link test, it failed even harder

comodo online security is great against vxvault links (some day-old links) but it is useless in my new tests (0-3 day-old)
it's time to abandon these 2

we can simple add the filter: http://vxvault.net/URL_List.php
to ublock => we can replace comodo or norton or some other crappy extensions, even more effectively

 

[Moonhorse]

Do internet explorer have same kind of blocking results as edge?

I had weird idea last night about using internet explorer if i can manage to get adblocker on it, adguard i wont pay for tho

 

[Evjl's Rain]

Do internet explorer have same kind of blocking results as edge?

yes,
IE: 17/20

p/s: testing heimdal/thor and sophos
updated the results

 

[Moonhorse]

It seems spybot search & destroy also have internet protection on their free version, ever tried it @Evjl's Rain

Since it seems some people dislike malwarebytes nowadays and zemana has come cover it, but zemana doesnt have free web protection at all

 

[Evjl's Rain]

It seems spybot search & destroy also have internet protection on their free version, ever tried it @Evjl's Rain

really, I don't see them mention it anywhere on the website

edit: ok, I just saw it

 

[Moonhorse]

really, I don't see them mention it anywhere on the website

edit: ok, I just saw it

Internet Protection - Spybot Anti-malware and Antivirus yup

 

[Evjl's Rain]

updated
avast, sophos home premium, heimdal pro

 

[Evjl's Rain]

Internet Protection - Spybot Anti-malware and Antivirus yup

I just tested it. It blocked nothing
the option had to be enabled manually. After enabling, I noticed my proxy setting was changed -> it worked correctly

 

[Moonhorse]

I just tested it. It blocked nothing
the option had to be enabled manually. After enabling, I noticed my proxy setting was changed -> it worked correctly

sad to hear, thanks for testing it out

 

[tsunami]

@Evjl's Rain was that heimdal pro stable or RC/Beta? Love your work btw.

 

[Evjl's Rain]

@Evjl's Rain was that heimdal pro stable or RC/Beta? Love your work btw.

I use the official stable version for the fairest result
if I use the RC version, someone might argue "oh, RC might have bugs,..."
but I can test the RC version if you want because somebody said it had better detection rate

 

[Sunshine-boy]

, don't argue Heimdal has A, B, C features

No Need to Argue.it's Fakeware Thnx for testing.

 

[tsunami]

I use the official stable version for the fairest result
if I use the RC version, someone might argue "oh, RC might be bugs,..."
but I can test the RC version if you want because somebody said it had better detection rate

If it's alright with you seems interesting. @Evjl's Rain

 

[yitworths]

No Need to Argue.it's Fakeware Thnx for testing.

are ya calling heimdal a fakeware?

 

[upnorth]

are ya calling heimdal a fakeware?

That was funny. Can guess he's just pulling your legs.

 

[Evjl's Rain]

If it's alright with you seems interesting. @Evjl's Rain

Heimdal/Thor RC: 14/20
10 minutes later, 16/20
still, not very impressive

sidenote: I noticed Heimdal RC continuously changing DNS back to 127.7.7.3 despite my effort to change it to 8.8.8.8 -> working DNS hijack protection

 

[Sunshine-boy]

I found web filtering at DNS level is useless if you use google chrome cuz chrome bypass your DNS.
Disable Async DNS resolver in Google Chrome

 

[toto_10]

@Evjl's Rain

What filters can you recommend for uBlock Origin? I'm currently using your setup from your post July 12, 2018. I prefer uBlock as light and effective as possible.

 

[yitworths]

I noticed Heimdal RC continuously changing DNS back to 127.7.7.3 despite my effort to change it to 8.8.8.8

So, heimdal make use of dns level filtration or does it also use heuristic?

 

[yitworths]

What filters can you recommend for uBlock Origin

you may use huge database of blacklist, but trust me it won't be fruitful in the long run.