Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[imuade]

My favourite combo is CleanBrowsing DNS + Blocksi Web Filter (set to warn unrated websites too)

 

[blackice]

My favourite combo is CleanBrowsing DNS + Blocksi Web Filter (set to warn unrated websites too)

Does clean browsing perform fairly well with CDNs and not have resolution problems?

Edit: remembering my resolution issue with them was the timeout they had on DNS over TLS before. It was too short and would fail 1 in every 20 or so resolutions.

 

[imuade]

Does clean browsing perform fairly well with CDNs and not have resolution problems?

Edit: remembering my resolution issue with them was the timeout they had on DNS over TLS before. It was too short and would fail 1 in every 20 or so resolutions.

Not sure if I have understood correctly your question.
Before I used CleanBrowsing DNS on DNScrypt and I didn't have any issue

 

[TairikuOkami]

Does clean browsing perform fairly well with CDNs and not have resolution problems?

It happens to me sometimes, I have DNS Cache disabled, so I guess they have some limit for the number of DNS requests, but F5 usually fixes it.

 

[blackice]

Not sure if I have understood correctly your question.
Before I used CleanBrowsing DNS on DNScrypt and I didn't have any issue

I worded my question poorly (sleep deprivation). My biggest curiosity is if cleanbrowsing has any problems with CDNs/streaming services routing to far away servers. Second question has more to do with DoT, which I think is just a problem with timeouts set on their end. Quad9 had the same problem. Cloudflare is much more forgiving in their timeouts.

It happens to me sometimes, I have DNS Cache disabled, so I guess they have some limit for the number of DNS requests, but F5 usually fixes it.

I had this same issue with Quad9 and DoT.

 

[imuade]

I worded my question poorly (sleep deprivation). My biggest curiosity is if cleanbrowsing has any problems with CDNs/streaming services routing to far away servers. Second question has more to do with DoT, which I think is just a problem with timeouts set on their end. Quad9 had the same problem. Cloudflare is much more forgiving in their timeouts.


I had this same issue with Quad9 and DoT.

Sometimes I watch sports on streaming and I have never experienced any issue

 

[ebocious]

Chrome+WDBP 18/20
chrome+WDBP+BDTL 20/20 => my recommended combo worked perfectly

How about Chrome+MBBE+BDTL?
Or Chrome+MBBE+WDBP?
Just curious to see how they stack up. I see the sense in your recommended combo: WDBP shouldn't be going anywhere so long as MS is around, and Bitdefender is about the most popular AV in the business; I've used BDTL longer than the rest. But I'm also interested in the viability of a signature-less extension like MBBE. BDTL has cloud analysis as well as signatures, which is great as long as they have paying customers.

 

[Evjl's Rain]

How about Chrome+MBBE+BDTL?
Or Chrome+MBBE+WDBP?
Just curious to see how they stack up. I see the sense in your recommended combo: WDBP shouldn't be going anywhere so long as MS is around, and Bitdefender is about the most popular AV in the business; I've used BDTL longer than the rest. But I'm also interested in the viability of a signature-less extension like MBBE. BDTL has cloud analysis as well as signatures, which is great as long as they have paying customers.

MBBE is good bur the problems are it consumes a lot of CPU as long as you interact with your browser (scrolling, clicking,...) and it has quite a lot of FPs
WDBP doesn't have these issues because WDBP and BDTL only check a website once after it finishes loading and doesn't check anything else until visit another link (same or different domain)

moreover, since the release of chromium Edge, more and more users are switching => better database, better protection for WDBP and smartscreen

although WDBP can be weaker than malwarebytes, I still use it for performance purpose

 

[ebocious]

MBBE is good bur the problems are it consumes a lot of CPU as long as you interact with your browser (scrolling, clicking,...) and it has quite a lot of FPs
WDBP doesn't have these issues because WDBP and BDTL only check a website once after it finishes loading and doesn't check anything else until visit another link (same or different domain)

moreover, since the release of chromium Edge, more and more users are switching => better database, better protection for WDBP and smartscreen

although WDBP can be weaker than malwarebytes, I still use it for performance purpose

Yeah. I'm kind of on the fence about the FPs. While it is CPU-heavy, it gives me a little sense of security when I think of somebody releasing an ItW exploit for Spectre. I once watched a rogue page open 10 new tabs, I blinked, and all ten tabs had the Malwarebytes logo when I opened my eyes. I'm not saying half a second figuratively, I'm saying half a second literally. I'd love it if someone can give me a signature-less extension that produces fewer FPs while still delivering the results. Anyway, I appreciate the info and your hard work. Thank you!

 

[Gandalf_The_Grey]

Tested the 20 malware links from @Evjl's Rain with Windows Defender and MS Edge Dev:
SmartScreen on Edge blocked 3/20
Downloads were blocked by Edge 16/20
Only the zip file went through.

VirusTotal

VirusTotal

www.virustotal.com

Tested the 32 phishing links from @Evjl's Rain with Windows Defender and MS Edge Dev:
SmartScreen on Edge blocked 26/32

It annoys me that the zip file went trough.
I submitted the file to Microsoft and they haven't done anything with it yet.
Still undetected by Windows Defender...
Thinking of going back to Kaspersky Security Cloud Free (together with Hard Configurator of course)

 

[TairikuOkami]

I wonder, is there an extension, which would allow me to use google safe browsing, ...

I guess, Google actually likes me, because they just did. It sucks at the moment, only 2 detections of out ~100 links, but it is version 1, so it is OK.

Suspicious Site Reporter

Extension for reporting suspicious sites to Safe Browsing.

chrome.google.com

 

[simmerskool]

anyone used or tested the following
OPSWAT File Security for Chrome is a browser extension designed to enhance the security of browser users by verifying files before being downloaded. The browser extension connects to MetaDefender Cloud API and works as an automated file security tool, keeping users safe from file based infections. The extension is a free tool provided by OPSWAT.

File Security for Chrome is now open source

We are excited to announce that our File Security for Chrome browser extension is now open source! OPSWAT File Security for Chrome is a browser extension designed to enhance the security of browser users by verifying files before being downloaded. The browser extension connects to MetaDefender…

www.opswat.com

GitHub - OPSWAT/metadefender-browser-extension: browser extension for scanning with MetaDefender

browser extension for scanning with MetaDefender. Contribute to OPSWAT/metadefender-browser-extension development by creating an account on GitHub.

github.com

Chrome Web Store

Add new features to your browser and personalize your browsing experience.

chrome.google.com

 

[simmerskool]

Edit: some reviews at Chrome Web Store say it is (was) problematic??

 

[Evjl's Rain]

Edit: some reviews at Chrome Web Store say it is (was) problematic??

I did. It was a bit slow and sometimes unstable
It took too much time to scan a file
manual uploading to VT is faster

 

[oldschool]

Edit: some reviews at Chrome Web Store say it is (was) problematic??

Sounds like it's simply another junkware app to me. Pretty useless.

 

[Evjl's Rain]

a new test with 20 links
chrome 19/20
avira 15/20
emsisoft 11/20
malwarebytes 17/20
Norton 9/20
Comodo 0/20
Bitdefender 12/20
WDBP 18/20

my combo: Chrome+WD+BTDL = 20/20

 

[Gandalf_The_Grey]

a new test with 20 links
chrome 19/20
avira 15/20
emsisoft 11/20
malwarebytes 17/20
Norton 9/20
Comodo 0/20
Bitdefender 12/20
WDBP 18/20

my combo: Chrome+WD+BTDL = 20/20

Can you share the links?

 

[Evjl's Rain]

Can you share the links?

here you are

link test 13/7/19 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

 

[bribon77]

My combo: Chrome+ Emsisot Browser Security.
Emsisoft: 12.
Chrome: 8.
Total.20/20. detected
Thanks for sharing.

 

[Gandalf_The_Grey]

My Combo: Edge Dev + Bitdefender TrafficLight:
Bitdefender TraficLight: 12/20
SmartScreen: 12/20
Downloads blocked by Edge Dev: 8/20
So in total 20/20

TrafficLight blocked first and then SmartScreen blocked exactly the same links.

For 8 files I was asked where to save them, but the actual downloads were blocked by Edge Dev as being unsafe.