Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[shmu26]

VirusTotal

This phishing link been up for more than 12 hours, why isnt any engine detecting it? I have reported it to multiple vendors without answer

Maybe because the link is broken?

On Chrome, I get:
This page isn’t working
secure.runescape.com-os.cz didn’t send any data.


ERR_EMPTY_RESPONSE

On Firefox, I get:
Secure Connection Failed

An error occurred during a connection to secure.runescape.com-os.cz.

The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
Please contact the website owners to inform them of this problem.

 

[ZeroDay]

Good Ole' Blocksi stopped it.

 

[Moonhorse]

Cert is 3 days old(?) And the link is from viewbotted fake livestream, when you type in fake details it will obviously redirect to original site

edit 1: heres another link, nothing blocking it VirusTotal

 

[Nestor]

Anyone tried Check point SandBlast Extension?I just installed on Chrome.According to AvLab it's the only one scored 100% on malicious and phising sites.

Test of web browser extensions for protection against malicious software

 

[oldschool]

Anyone tried Check point SandBlast Extension?I just installed on Chrome.According to AvLab it's the only one scored 100% on malicious and phising sites.

Test of web browser extensions for protection against malicious software

You may have missed this part: " Free version of the „Check Point Sandblast Agent for Browser” extension doesn’t have the most important functionality if it isn’t connected to the SandBlast service. ...

... Free version of the extension didn’t meet requirements for scanning downloaded threats, so we tested a commercial version at the request of the developer ... "

 

[LDogg]

Seems strange that this phishing link hasn't been picked up at all by most vendors.

~LDogg

 

[Nestor]

You may have missed this part: " Free version of the „Check Point Sandblast Agent for Browser” extension doesn’t have the most important functionality if it isn’t connected to the SandBlast service. ...

... Free version of the extension didn’t meet requirements for scanning downloaded threats, so we tested a commercial version at the request of the developer ... "

Yes i saw that but at settings there are two switches to turn on.One is for phising sites and the other is for malicious downloads.In fact you turn on a sandbox ,which analyse every file downloaded, that seems to be working but i am not sure if i am missing something.

 

[Threadripper]

Thought it would be necessary to mention that lots, and I mean lots of these extensions send every URL you visit straight to the company in plain test (they'll say it's "encrypted" because of TLS but to them it's still plain test) so who knows what they collect and what they do with it - and uselessly if you were the victim of an MiTM attack the attacker would see the URLs you visit twice.

The only one I know that doesn't for sure is Emsisoft Browser Security (source):

Instead of sending each full website URL to a cloud server for matching, it only sends a calculated hash value of the domain name of each newly visited site to our servers once and then receives a list of matching patterns that are applied locally on your computer. Those patterns are then kept for successive visits of pages on the same host/domain, which not only speeds up the matching significantly, but also means that Emsisoft doesn’t know any of the details of your browsing activity.

The image below shows Bitdefender TrafficLight sending a URL in plain text straight to Bitdefender (source) to highlight the problem, those using these kinds of extensions should check and see if they use hashes or plain text.

 

[Terry Ganzi]

Anyone tried Check point SandBlast Extension?I just installed on Chrome.According to AvLab it's the only one scored 100% on malicious and phising sites.

Test of web browser extensions for protection against malicious software

(NOTE: your company must have either a SandBlast Appliance or access to the SandBlast Cloud Service in order to use this extension)

 

[Nestor]

(NOTE: your company must have either a SandBlast Appliance or access to the SandBlast Cloud Service in order to use this extension)

Indeed, only the phising mode is working (actually very good), i made a quick test,it's a little confusing the way it's presented at settings.

 

[bribon77]

Emsisoft Browser Security, does not detect it either

 

[Stas]

Emsisoft Browser Security, does not detect it either

My ESET blocks it:emoji_v:

 

[Gandalf_The_Grey]

Not behind my home computer, but has anybody tested the link against Windows Defender Browser Protection?

 

[Moonhorse]

Not behind my home computer, but has anybody tested the link against Windows Defender Browser Protection?

Tried, only eset detects them

VirusTotal
VirusTotal

The second link is that the whole site is about phishing and probably contains file. I often tend to watch livestreams on twitch.tv where runescape is only game wich is gated into real world trading and thats why people host viewbotted streams there. Usually the phishing urls are detected even by google safe browsing or by netcraft in last hand but... now the phish urls arent detected at all, but still leads to fake site

I think trace extension has the bad tld/url protection to block .com-os.cz like urls aswell
Forticlient has the block new sites option/ block unrated
Blocksi has block unrated option

So default block like extensions will block them now and in future, but the actual extensions except ESET doenst currently detect them and the urls are already day old, i have submitted them to netcraft wich rates risk rating @ 10, but still doesnt block them as phishing. From kaspersky i dont have answer yet

 

[Nestor]

Tried, only eset detects them

VirusTotal
VirusTotal

The second link is that the whole site is about phishing and probably contains file. I often tend to watch livestreams on twitch.tv where runescape is only game wich is gated into real world trading and thats why people host viewbotted streams there. Usually the phishing urls are detected even by google safe browsing or by netcraft in last hand but... now the phish urls arent detected at all, but still leads to fake site

I think trace extension has the bad tld/url protection to block .com-os.cz like urls aswell
Forticlient has the block new sites option/ block unrated
Blocksi has block unrated option

So default block like extensions will block them now and in future, but the actual extensions except ESET doenst currently detect them and the urls are already day old, i have submitted them to netcraft wich rates risk rating @ 10, but still doesnt block them as phishing. From kaspersky i dont have answer yet

Checkpoint Sandblast also detect it.

 

[ZeroDay]

Google safe browsing is now blocking it for me. I submitted the URL to Kaspersky as others have done but no reply yet.

 

[Windows_Security]

I think trace extension has the bad tld/url protection to block .com-os.cz like urls aswell

Correct see with (PRIVATE profile) and without (NORMAL profile) Trace

 

[Moonhorse]

36 hours since i posted it here and finally some vendors are blocking it as phishing, i think im going to install trace back. Its kind of first time for me to see urls are up this long without detection....still not sure should i be worried or not

 

[Threadripper]

Most phishing sites aren't up for longer than 24/49 hours, why such worry?

 

[Windows_Security]

Because a respected member's name is used?