Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

Hello Evjl's Rain,

I am curious, I know that in your tests the VX Vault list is better than the default Ublock Origin malware lists (Malvertising filter list by Disconnect, Malware Domain List, Malware Domains, and Spam404), but how would you rank those default Ublock Origin malware lists from best to worst?

Thank you,
-John Jr

makware domain list ~ malware domain >>> disconnect = spam404 ~ 0
they are basically useless. In 2 years of using my browser with them enabled, I rarely saw any block
while I could see many with other filters
vxvault list is just a failsafe when you accidentally click on a new malware links which are missed by other extensions

 

[goodjohnjr]

makware domain list ~ malware domain >>> disconnect = spam404 ~ 0
they are basically useless. In 2 years of using my nrowser with them enabled, I rarely saw any block
while I could see many with other filters
vxvault list is just a failsafe when you accidentally click on a new malware links which are missed by other extensions

That was fast, thank you very much Evjl's Rain.

-John Jr

 

[Moonhorse]

Have done recently some real life phishing tests, just explain how good netcraft is for basic user.

heres example with one url;

Firefox fail:

opera fail:

chrome fail:

AVG free fail:



Netcraft blocks url:


I know firefox, opera, etc clones use google safe browsing but sometimes their database is updated late comparing to google chrome

edit:

Avira extension maybe will block it aswell

 

[Evjl's Rain]

for phishing, no comparison, netcraft wins

avast/AVG has weak phishing protection because they explained to me clearly that they only add frequently visited phishing, not the latest phishing links to reduce the size of the update
the advice me to install avast online security for better phishing protection and it did. Avast online security is a quite powerful anti-phishing extension, but not as good as netcraft

any browser other chrome has 30min delay database of google safe browsing. There is an option in google chrome, which reports malicious sites in realtime and blocks them. In saw some phishing missed but 10s later without refreshing the page, they were blocked. Many people disable it due to privacy concern

 

[Sunshine-boy]

option in google chrome, which reports malicious sites in realtime and blocks them

Hi,where is it?in flags? or?

 

[Evjl's Rain]

Hi,where is it?in flags? or?

 

[HarborFront]

Have done recently some real life phishing tests, just explain how good netcraft is for basic user.

heres example with one url;

Firefox fail:View attachment 196411

opera fail:
View attachment 196412
chrome fail:
View attachment 196413
AVG free fail:
View attachment 196414


Netcraft blocks url:
View attachment 196415

I know firefox, opera, etc clones use google safe browsing but sometimes their database is updated late comparing to google chrome

edit:View attachment 196416

Avira extension maybe will block it aswell

Malwarebytes extension blocks the site. ESET IS also blocks it

Interestingly, uBO with the followings did not block the site

https://hosts-file.net/psh.txt
https://openphish.com/feed.txt

 

[Moonhorse]

Malwarebytes extension blocks the site. ESET IS also blocks it

Interestingly, uBO with the followings did not block the site

https://hosts-file.net/psh.txt
https://openphish.com/feed.txt

Twitch
Theres tons of ' fake streams' being viewbotted all the time, with so called fresh links i have been testing for fun. Maybe phishing exist in emails, but my email adresses aint leaked so i barely get any junkmail at all to test them out

 

[Ink]

If you're going to test Netcraft and Avira extensions, don't forget Windows Defender Browser Protection by Microsoft, to compare with Google SafeBrowsing.

Have done recently some real life phishing tests, just explain how good netcraft is for basic user.

Netcraft blocks url:
View attachment 196415

Blocked by WD SmartScreen & WDBP for Chrome.

 

[Mahesh Sudula]

The AV engines in the VT either scan through Cloud or the Av's blacklisted lists for sure..
How ever real time detections may differ to some extent ..KAspersky & NOrton use heuristic analysis(proactive approach) to spot a phished URL which may not reflect in the VT..
Net craft is a anti phishing champ since years..That's for sure!

 

[Ink]

https://www.kaspersky.com/safe-kids
Can you pls test it? I think it can also block malicious websites but not sure.

Website states it blocks Adult websites, nothing about Malicious sites. It also tracks kids' phones with GPS.

 

[imuade]

Has anyone tested adaware web companion? Any thought about it?

 

[Mahesh Sudula]

Has anyone tested adaware web companion? Any thought about it?

It uses bit defender nimbus cloud ..so there would be top notch antiphishing.

 

[imuade]

It uses bit defender nimbus cloud ..so there would be top notch antiphishing.

And what about malware protection?
Furthermore, how is it different from BD Trafficlight?

 

[Sunshine-boy]

nothing about Malicious sites

I tested safe kids and it almost blocked nothing.
it only blocks URLs that end to a malicious EXE and won't block phishing or other kinds of malicious URLs.

 

[Mahesh Sudula]

And what about malware protection?
Furthermore, how is it different from BD Trafficlight?

As for as signatures concerned..it is from Bit defender including Cloud access
But not sure about its Behaviour blocker (Active Virus Control)..
as per my tests it is not as same as BD (Active Threat Control) ..
My open opinion on Ad aware... leave it..not at all recommended even as free _/\_

 

[imuade]

As for as signatures concerned..it is from Bit defender including Cloud access
But not sure about its Behaviour blocker (Active Virus Control)..
as per my tests it is not as same as BD (Active Threat Control) ..
My open opinion on Ad aware... leave it..not at all recommended even as free _/\_

Thanks, but I was not talking about adaware antivirus+ vs Bitdefender Free AV, I was comparing adaware web companion with Bitdefender Trafficlight

 

[Mahesh Sudula]

Thanks, but I was not talking about adaware antivirus+ vs Bitdefender Free AV, I was comparing adaware web companion with Bitdefender Trafficlight

it is almost exact copy from Bit defender..

 

[TairikuOkami]

Website states it blocks Adult websites, nothing about Malicious sites.

Adult websites host 5-10% of malicious content, that is not a big number, but every little bit helps, especially since it is default deny. The only downside is (except blocking adult content, rofl), that the better filter the more legitimate content is blocked as well, like image/video hosting.

 

[Ink]

I tested safe kids and it almost blocked nothing.
it only blocks URLs that end to a malicious EXE and won't block phishing or other kinds of malicious URLs.

Did you use PC/Mac or Android/iOS version of Safe Kids? I would imagine that most of the younger gen. would be active on Phones rather than Laptops.