Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[tsunami]

DNS for comparison, not bad at all:

Cleanbrowsing - 13/20
Neustar Threat - 15/20
Yandex/Sophos - 1/20
Quad9 - 0/20

Wow, Quad9 totally shocked me, going back to Neustar.

is Yandex and Sophos related to each other?

 

[CyberTech]

I had been running emsisoft extension for several months and it hadn't blocked anything, not a single link
I just switched to BDTL for 2 weeks, it has been blocking a few links => goodbye emsisoft
WDBP has been working great

something can be good in theory but in reality and in some specific countries, others are better. BD has much larger user database than emsisoft in my country which can explain why it's better

just did a new test to see how the extensions are developing, 20 links from urlhaus

chrome 16/20
Avira 10/20
emsisoft 9/20 but 1 downloaded
malwarebytes 13/20
norton 6/20
BD trafficlight (BDTL) 12/20
WDBP 16/20 but some downloaded

late test:
adguard chrome extension (malware protection: on, default settings): 1/20

Chrome+WDBP 18/20
chrome+WDBP+BDTL 20/20 => my recommended combo worked perfectly

Thanks for testing out, that's awesome man what about Firefox? should i uninstall EBS and install WDBP+BDTL on FF ?


Edit: never mind there is no WDBP addons for FF

 

[conceptualclarity]

With Norton ConnectSafe being discontinued, what will happen to K9 ?
I've been getting this since yesterday...

View attachment 196961

Yep me too,but it's working.I am waiting to see if it is just a simple maintenance or it will be shut down.

Why do these big corporations like Symantec acquire things just to kill them? it's sickening.

 

[Evjl's Rain]

Can you also try testing KeweonDNS and nextDNS?

Thanks

keweon is weak
I don't know about nextDNS. I will check it out later

Thanks for testing out, that's awesome man what about Firefox? should i uninstall EBS and install WDBP+BDTL on FF ?


Edit: never mind there is no WDBP addons for FF

if WDBP is not available, I suggest keeping emsisoft

 

[Evjl's Rain]

Now I test phishing blocking ability (not my priority)
phishtank: 10 verified, 11 unverified
openphish 11

Spoiler: links

phishing 16/6/2019 - Pastebin.com

pastebin.com

chrome 29/32
avira 22/32
emsisoft 23/32
malwarebytes 13/32
Netcraft 27/32
Norton 24/32
BDTL 6/32 (tested several times)
WDBP 17/32 (tested twice)

Chrome+WDBP+BDTL 29/32

conclusion: BD is going downwards against phishing
norton shows some light, still useless against malwares
malwarebytes is weak against phishing
WDBP is not great against phishing but great against other threats
google safe browsing is consistent

 

[TairikuOkami]

is Yandex and Sophos related to each other?

Yandex.DNS uses its own anti-virus software operating on Yandex algorithms, as well as signature technology by Sophos.

 

[Gandalf_The_Grey]

just did a new test to see how the extensions are developing, 20 links from urlhaus

chrome 16/20
Avira 10/20
emsisoft 9/20 but 1 downloaded
malwarebytes 13/20
norton 6/20
BD trafficlight (BDTL) 12/20
WDBP 16/20 but some downloaded

late test:
adguard chrome extension (malware protection: on, default settings): 1/20

Chrome+WDBP 18/20
chrome+WDBP+BDTL 20/20 => my recommended combo worked perfectly

Thanks again for your testing, much appreciated!
Tested the same links on my system with MS Edge Dev 76.0.182.6 as browser and Kaspersky Security Cloud Free 20.0.14.1085(b) as AV:
The results are not scientific because both act on the links:
Edge SmartScreen : 15/20
Downloads blocked by Edge 5/20
KSCF: 13/20
Downloads blocked by Kaspersky 2/20
Together everything was blocked by my config.

 

[Gandalf_The_Grey]

Now I test phishing blocking ability (not my priority)
phishtank: 10 verified, 11 unverified
openphish 11
chrome 29/32
avira 22/32
emsisoft 23/32
malwarebytes 13/32
Netcraft 27/32
Norton 24/32
BDTL 6/32 (tested several times)
WDBP 17/32 (tested twice)

Chrome+WDBP+BDTL 29/32

conclusion: BD is going downwards against phishing
norton shows some light, still useless against malwares
malwarebytes is weak against phishing
WDBP is not great against phishing but great against other threats
google safe browsing is consistent

Tested the same links on my system with MS Edge Dev 76.0.182.6 as browser and Kaspersky Security Cloud Free 20.0.14.1085(b) as AV:
The results are not scientific because both act on the links:
Edge: 25/32
KSCF: 27/32
Together they blocked everything.

 

[Evjl's Rain]

Tested the same links on my system with MS Edge Dev 76.0.182.6 as browser and Kaspersky Security Cloud Free 20.0.14.1085(b) as AV:
The results are not scientific because both act on the links:
Edge: 25/32
KSCF: 27/32
Together they blocked everything.

the reason why I still use chromium-based browsers which have google safe browsing is that I can install WDBP so I have double protection (officially)
while with edge, there is no official extension from google to add the GBS support so I lose 1 layer
after an exe is downloaded from chrome, bypassing both GBS and WDBP, windows smartscreen will be triggered. So many layers for me to ensure the system is protected

 

[Gandalf_The_Grey]

the reason why I still use chromium-based browsers which have google safe browsing is that I can install WDBP so I have double protection (officially)
while with edge, there is no official extension from google to add the GBS support so I lose 1 layer
after an exe is downloaded from chrome, bypassing both GBS and WDBP, windows smartscreen will be triggered. So many layers for me to ensure the system is protected

Yes that would be the primary reason to keep using Google Chrome
But I'm trying the new Chromium based Edge Dev now.
Together Kaspersky Security Cloud Free it's a great combo.

 

[Evjl's Rain]

Yes that would be the primary reason to keep using Google Chrome
But I'm trying the new Chromium based Edge Dev now.
Together Kaspersky Security Cloud Free it's a great combo.

for me, google chrome is so bloated with useless tools which regularly consume resources in the background
I opted in chromium browser by woolyss, a clean version of chrome like AOSP vs. android from OEMs
I never look back. Perhaps, it's better edge? I don't know
I think they can cope with manifest v3 in the future by releasing adblocker-friendly versions

 

[TairikuOkami]

Now I test phishing blocking ability (not my priority)
phishtank: 10 verified, 11 unverified
openphish 11

Cleanbrowsing - 9/32
Neustar Threat - 6/32

2 hours later

Cleanbrowsing - 21/32
Neustar Threat - 19/32

This shows the advantage of extensions over DNS. It takes some time to update DNS and DNS can not block legit webpages hosting bad links.

 

[AriDfoix]

I opted in chromium browser by woolyss,

Same, is my main browser from a couple of years, on Android instead Bromite+BromiteWebView is main + PrivacyBrowser as fallback : )

 

[TairikuOkami]

I wonder, is there an extension, which would allow me to use google safe browsing, something like this no longer updated:

Google Safe Browsing

This extension checks every url u visiting automatically and alert you if any website contains malware. It uses google safe browsing lookup API .

addons.opera.com

 

[Gandalf_The_Grey]

Tested the 20 malware links from @Evjl's Rain with Windows Defender and MS Edge Dev:
SmartScreen on Edge blocked 3/20
Downloads were blocked by Edge 16/20
Only the zip file went through.

VirusTotal

VirusTotal

www.virustotal.com

Tested the 32 phishing links from @Evjl's Rain with Windows Defender and MS Edge Dev:
SmartScreen on Edge blocked 26/32

 

[SeriousHoax]

the reason why I still use chromium-based browsers which have google safe browsing is that I can install WDBP so I have double protection

Actually, Firefox uses Google safe browsing too but sadly Microsoft haven't released WBP for Firefox yet.

 

[Evjl's Rain]

Actually, Firefox uses Google safe browsing too but sadly Microsoft haven't released WBP for Firefox yet.

firefox uses GSB but with delayed database update
I have tested both of them. Firefox's GSB was always inferior to chrome. Sometimes, much worse

 

[SeriousHoax]

firefox uses GSB but with delayed database update
I have tested both of them. Firefox's GSB was always inferior to chrome. Sometimes, much worse

Yes, that's true. Chrome loads the database directly from their server but Firefox doesn't do that due to privacy issue. It downloads the list every 30 minutes and uses hashes instead of URLs to detect bad sites.
Full details here

 

[TairikuOkami]

Firefox's GSB was always inferior to chrome. Sometimes, much worse

Yandex is way worse, even useless, in one test it was 1/20 and the second one 0/32, after 2 days, it is still the same. Sophos file scanning is the same, just 1 detection. I wanted to disable it, but it keeps bugging me to enable it, so I just keep it on, but it is like there is nothing there. :emoji_expressionless:

 

[Evjl's Rain]

Yandex is way worse, even useless, in one test it was 1/20 and the second one 0/32, after 2 days, it is still the same. Sophos file scanning is the same, just 1 detection. I wanted to disable it, but it keeps bugging me to enable it, so I just keep it on, but it is like there is nothing there. :emoji_expressionless:

wow, the last time I tested, it was quite close to GSB but it's surprising how bad it is today