Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[HarborFront]

it is a list of the latest malwares from urlhaus. Someone created this filter and updates it 2 times a day => this can be a problem but still worth adding
this is a source that I use to test extensions where many of the tested extensions miss

Thanks

There are many filters out there for uBO. Like to list the bests which will not bog down net surfing?

 

[Evjl's Rain]

Thanks

There are many extensions out there for uBO. Like to list the bests which will not bog down net surfing?

any of them if you don't add too many filters. It should be less than 300-500k filters depends on your specs
ublock seems to be the lightest and most configurable
adguard is the least configurable, can't update custom filters

ublock because you can add all types of filter available and it's fully compatible

 

[Gandalf_The_Grey]

any of them if you don't add too many filters. It should be less than 300-500k filters depends on your specs
ublock seems to be the lightest and most configurable
adguard is the least configurable, can't update custom filters

ublock because you can add all types of filter available and it's fully compatible

In the new AdGuard beta 3.0.3 you van add and update custom filters.
It's a bit lighter than before, but uBlock remains the lightest and most configurable.

 

[Windows_Security]

@Evjl's Rain

Special request: ADD off the shelf Chrome with safe browsing and popup/adblock enabled when testing malware/phishing websites with these two ADDITIONAL FLAGS enabled:
- block unsafe downloads over insecure connections
- mark non-secure origins as non-secure (actively mark as unsafe)

Consider every page non-blocked over HTTPS connection as a FAIL. This makes the testing job easier for you since you only have to check HTTPS websites, for this 'hardened Chrome option".

This 'hardened Chrome variant' provides a better insight over the added value of an extension or adding an additional URL block list to an already bloated micro management general purpose blocker.

see Video - McAfee WebAdvisor Tested (Computer Solutions)

 

[Moonhorse]

In the new AdGuard beta 3.0.3 you van add and update custom filters.
It's a bit lighter than before, but uBlock remains the lightest and most configurable.

View attachment 206776View attachment 206777

Wow beta and nightly for testers is free ??

 

[Gandalf_The_Grey]

Wow beta and nightly for testers is free ??

It's just the extension I'm using and not the windows program.
The extension is always free.

 

[JiSingh12]

I think this filter (for ublock only) is worth adding
https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter.txt

Does this include nano adblocker since it is based of uBlock Origin (uBO)

 

[Moonhorse]

Does this include nano adblocker since it is based of uBlock Origin (uBO)

You can add it to nano adblocker similar way you add filters to ublock origin

You can see wich lists your ublocker has, and nano has more filters by default, but no...it doesnt include that filter evjl posted

 

[JiSingh12]

You can add it to nano adblocker similar way you add filters to ublock origin

Yes my question was is this filter compatible with Nano Adblocker since it only says uBO, so i was not sure. I realise it is not included by default, lol, just wanted to know if it works within Nano

 

[Evjl's Rain]

Yes my question was is this filter compatible with Nano Adblocker since it only says uBO, so i was not sure. I realise it is not included by default, lol, just wanted to know if it works within Nano

yes, nano is identical to ublock

 

[Evjl's Rain]

@Evjl's Rain

Special request: ADD off the shelf Chrome with safe browsing and popup/adblock enabled when testing malware/phishing websites with these two ADDITIONAL FLAGS enabled:
- block unsafe downloads over insecure connections
- mark non-secure origins as non-secure (actively mark as unsafe)

Consider every page non-blocked over HTTPS connection as a FAIL. This makes the testing job easier for you since you only have to check HTTPS websites, for this 'hardened Chrome option".

This 'hardened Chrome variant' provides a better insight over the added value of an extension or adding an additional URL block list to an already bloated micro management general purpose blocker.

see Video - McAfee WebAdvisor Tested (Computer Solutions)

I will check it out. Thanks
however, I'm afraid it would block some safe downloads coming from http sites. It's a deal-breaker for me

 

[Windows_Security]

@Evjl's Rain

I do appreciate your efforts and tests. I sincerely think it will provide new insights. When it is so easy to protect oneself from malware (drive-by) downloads from HTTP websites, this point of view should be taken into consideration (average PC-user does not play with software but simply uses it), maybe not for power users testing software, but for people helping 'Average Joe/Jane' PC-users.

E.g when Bitdefender Traffic light blocks 17 out of 30 and Malware Bytes blocking blocks 28 out of 30, it might make sense to replace Bitdefender with Malware Bytes extension. When you only had one sample originating from HTTPS and that one was blocked by Bitdefender Trafficlight and missed by Malware Bytes this fact would change the perspective on what extension to choose (advise) for average users.

Regards Kees

 

[bribon77]

I think this filter (for ublock and ublock's folks, only) is worth adding
https://gitlab.com/curben/urlhaus-filter/raw/master/urlhaus-filter.txt

Added to ublock, Thank you

 

[Brie]

malwarebytes blocked many well known legitatite sites. i could not white list them. i had to

uninstall malwarebytes. just my opinion.

 

[Moonhorse]

malwarebytes blocked many well known legitatite sites. i could not white list them. i had to

uninstall malwarebytes. just my opinion.

Kinda user dependant, myself i rarely run into that case and whitelisting is very simple
With decent high-end pc i have no slowdowns, wich probably do exist on low specs pcs
I think i rather have higher security with higher false positive count, than hitting miss once

 

[Windows_Security]

Checked latest links from VX-Vault, MalC0de, OpenPhish and Phisktank (5 of each in that order):

20 in total - 13 x Bitdefender blocks (red B) and 7 Google Safe browsing blocks (Security error) for what I can check BDTL * GSB are best combo (EDIT) for me.

 

[JiSingh12]

check BDTL * GSB are best combo

I wonder how effective GSB is on its own.

 

[Windows_Security]

I wonder how effective GSB is on its own.

Just look at this thread and the constantly updated tests of Evjl

 

[JiSingh12]

Just look at this thread and the constantly updated tests of Evjl

Oh yeah...
I .. I totally forgot about those:emoji_fearful: silly me.
101% blame that on my brain being tired..

 

[g4nu5]

thank you for this article , Bitdefender with ADP its usefull .