Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[BoraMurdar]

edge is better than WDBP

Just to resume, doesn't this mean that Edge filtering system is using Microsoft definitions better than WDBP? Ignore the other components, just Smart Screen for Chromium Edge VS WDBP...

 

[Evjl's Rain]

Just to resume, doesn't this mean that Edge filtering system is using Microsoft definitions better than WDBP? Ignore the other components, just Smart Screen for Chromium Edge VS WDBP...

according to what I saw during testing microsoft edge vs WDBP:
- edge uses similar database as WDBP + it can also check for file hash for possible malware. After downloading a file, edge takes some time to analyze it and give us the result of analysis, similarly to chrome
- WDBP does not check the file. It only checks the link
- edge also warns us about suspicious websites or files. WDBP does not warn -> only blocks known malicious contents

They are my observations, I can't find any detail explanation of WDBP
I might be very wrong about file hash. It's my assumption but Edge smartscreen does check the file for malware

here are some tests that showed edge/IE smartscreen blocked many more than WDBP

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

 

[oldschool]

according to what I saw during testing microsoft edge vs WDBP:
- edge uses similar database as WDBP + it can also check for file hash for possible malware. After downloading a file, edge takes some time to analyze it and give us the result of analysis, similarly to chrome
- WDBP does not check the file. It only checks the link
- edge also warns us about suspicious websites or files. WDBP does not warn -> only blocks known malicious contents

They are my observations, I can't find any detail explanation of WDBP
I might be very wrong about file hash. It's my assumption but Edge smartscreen does check the file for malware

here are some tests that showed edge/IE smartscreen blocked many more than WDBP

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

Hot Take - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Comparison between browser extensions Test 29/12 Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings Test 24/11 Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings Test 12/11 Q&A - [Updated 12/11/2018] Browser extension comparison...

malwaretips.com

I would agree with your observation about Smartscreen > WDBP. But like all things M$, little documentation. They like to keep things "secret"!

 

[SeriousHoax]

When first updated malwarebytes, it did not block any malwares or ads, nothing. I went to settings -> unchecked protection -> re-checked -> working

It's not working even after doing this on Firefox and also the UI looks different

 

[Evjl's Rain]

It's not working even after doing this on Firefox and also the UI looks different

so it should be reported to the developers. They revamped this extension a lot, so do the codes -> new bugs

 

[oldschool]

And they require email. For an extension? Why?

 

[Burrito]

And they require email. For an extension? Why?

To spam the crap out of you?

This is being discussed at the Malwarebytes forum.

Malwarebytes Browser Guard Question

Why do Malwarebytes Browser Guard need access to email adress ? For the first time I come across an application that requires this, and I would like to know why this is necessary and does this threaten privacy ?

forums.malwarebytes.com

My guess is that it's just a bug.

But ya never know.... maybe in their minds, if you use their tool for free, they at least get to send you a few marketing emails...

I dunno.

 

[Harputlu]

I am using malwarebytes antimalware premium. can I use Malwarebytes Browser Guard ?

 

[Evjl's Rain]

I am using malwarebytes antimalware premium. can I use Malwarebytes Browser Guard ?

you don't need it. Malwarebytes premium has a system-wise web filter already
malwarebytes browser guard gives you clickbait protectect and ad/tracker blocker -> you don't really need

 

[Gandalf_The_Grey]

My current combination of Edge Dev version 78.0.249.1 with AdGuard (extension) and Ziggo Safe Online 17.6 (F-Secure Safe) blocked all links except 24d5750.msi was downloaded but blocked/warning about being unsafe:

AdGuard even blocked 3 links
Thanks @Evjl's Rain for the test and the links

 

[ebocious]

It's not working even after doing this on Firefox and also the UI looks different

Is MBBG out for Firefox? I think it's still the beta MBBE. Of course, if you say the UI looks different...

 

[SeriousHoax]

Is MBBG out for Firefox? I think it's still the beta MBBE. Of course, if you say the UI looks different...

The name is different also. It's Malwarebytes Browser Extension. Last time updated on August 22 and not beta.

 

[ebocious]

The name is different also. It's Malwarebytes Browser Extension. Last time updated on August 22 and not beta.

That's what I thought. Malwarebytes Browser Extension is the old name. The new Malwarebytes Browser Guard has not yet been released for Firefox.

 

[Lemon60]

Wow, i'm using BDTL about 1 year. Good time to download MBBG.

 

[SeriousHoax]

That's what I thought. Malwarebytes Browser Extension is the old name. The new Malwarebytes Browser Guard has not yet been released for Firefox.

There's still no WDBP extension for Firefox, MBBG hasn't released yet either. Always neglecting Firefox users :emoji_expressionless:

 

[ebocious]

There's still no WDBP extension for Firefox, MBBG hasn't released yet either. Always neglecting Firefox users :emoji_expressionless:

Yeah, Chrome gets all the attention. Firefox just gets left out in the cold.

 

[Burrito]

Malwarebytes Browser Guard Email Demand Update--

Sure enough, they want to send marketing emails.

And so there you have it.

They want to know you better.

Maybe you'll become pals with them..

 

[Evjl's Rain]

test 14/9/2019
29 malware links: doc, exe

Spoiler: links

test 29/9 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

chrome 23/29
avira 14/29
emsisoft 18/29
malwarebytes 23/29
Norton 11/29
Bitdefender 25/29
WDBP 26/29

 

[Evjl's Rain]

Phishing test 14/9/2019
avira 17/31
bitdefender 20/31
chrome 23/31
emsisoft 20/31
malwarebytes 26/31
netcraft 24/31
norton 28/31
WDBP 28/31

 

[Mahesh Sudula]

Phishing test 14/9/2019
avira 17/31
bitdefender 20/31
chrome 23/31
emsisoft 20/31
malwarebytes 26/31
netcraft 24/31
norton 28/31
WDBP 18/31

Seems as I said already,, Norton is back!
BD seems completely feeding on Web level protection over signatures.. MBAM too doing well