Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

Seems as I said already,, Norton is back!
BD seems completely feeding on Web level protection over signatures.. MBAM too doing well

no it's not. check my previous post against malware links
norton is okay against phishing but still poor against malwares

 

[goodjohnjr]

Phishing test 14/9/2019
avira 17/31
bitdefender 20/31
chrome 23/31
emsisoft 20/31
malwarebytes 26/31
netcraft 24/31
norton 28/31
WDBP 18/31

Hello @Evjl's Rain ,

Thank you very much for the new tests, I always look forward to them; out of Quad9 DNS and CleanBrowsing DNS and Adguard DNS which do you think is currently better overall in its blocking of malicious/phishing/scam/spam/grayware/adware/coin miner/et cetera websites?

Thank you,
-John Jr

 

[Evjl's Rain]

Hello @Evjl's Rain ,

Thank you very much for the new tests, I always look forward to them; out of Quad9 DNS and CleanBrowsing DNS and Adguard DNS which do you think is currently better overall in its blocking of malicious/phishing/scam/spam/grayware/adware/coin miner/et cetera websites?

Thank you,
-John Jr

cleanbrowsing has the best blocking
quad9 is meh, very poor
adguard is even poorer than quad9. However it can block ads and trackers => highly recommended for mobile devices especially ios devices (ios can fix DNS into a network)

 

[goodjohnjr]

cleanbrowsing há the best blocking
quad9 is meh, very poor
adguard is even poor than quad9. However it can block ads and trackers => highly recommended for mobile devices especially ios devices (ios can fix DNS into a network)

Hello @Evjl's Rain ,

Thank you very much for answering that.

I am surprised and disappointed to hear that about Quad9 DNS, I had hoped that they had improved since the last test, I thought they would be performing better thanks to all of their partners et cetera.

-John Jr

 

[TairikuOkami]

test 14/9/2019
29 malware links: doc, exe

Spoiler: links

test 29/9 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

cleanbrowsing has the best blocking

Indeed.

Cleanbrowsing Security: 22/29
Neustar Threat: 21/29
Quad9 DNS: 5/29
Adguard DNS with adult: 1/29
Yandex Browser Protect: 0/29
Firewall (blocking port 80): 26/29

 

[Gandalf_The_Grey]

Phishing test 14/9/2019
avira 17/31
bitdefender 20/31
chrome 23/31
emsisoft 20/31
malwarebytes 26/31
netcraft 24/31
norton 28/31
WDBP 18/31

A big thanks for testing this again
Can you also give us the links you used in this test?

 

[stefanos]

A big thanks for testing this again
Can you also give us the links you used in this test?

test 29/9 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

 

[Gandalf_The_Grey]

test 29/9 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

Thanks, but I think those are the malware links, not the phishing links.

 

[Evjl's Rain]

I will upload them but expect half of them to be dead by then
phishing dies fast

 

[TairikuOkami]

but I think those are the malware links, not the phishing links.

PhishTank | Join the fight against phishing is the best one for testing, there are many fresh paypal, microsoft and other links to try out yourself.
Note, that it takes DNS services a while to update the servers, unlike extensions, which should be able to detect them ASAP via the cloud.

 

[Evjl's Rain]

true. I find almost all of phishing links from phistank (verified online or unknown online)
openphish (free) updates every 12 hours so they might not be as new as phishtank

 

[Evjl's Rain]

sorry for my mistake.
WDBP blocked 28/31 phishing links

Spoiler: phishing

phishing 14/9/2019 - Pastebin.com

pastebin.com

 

[Burrito]

Seems as I said already,, Norton is back!
BD seems completely feeding on Web level protection over signatures.. MBAM too doing well

I suspect you are right.

Yes, this fine @Evjl's Rain test is not for malware. But Norton had become less good for phishing too. I think they *may* be bringing back each strength over time..

 

[Back3]

Using Malwarebytes with Firefox and WDBP and TrafficLight with Chrome. So far so good.

 

[goodjohnjr]

Indeed.

Cleanbrowsing Security: 22/29
Neustar Threat: 21/29
Quad9 DNS: 5/29
Adguard DNS with adult: 1/29
Yandex Browser Protect: 0/29
Firewall (blocking port 80): 26/29

Thank you for sharing that @TairikuOkami , I wonder how they would do against the phishing links.

-John Jr

 

[TairikuOkami]

I wonder how they would do against the phishing links.

Too late for that, 11 links are already dead, but it still is puzzling, that OpenDNS fails so much, since it maintains Phishtank, so it has first hand access to the source. Anyway, it has been like 24 hours, so if the rest did not catch up by now, I would not rely on them for blocking phishing.

Cleanbrowsing: 18/20
Quad9: 17/20
Neustar: 12/20
Adguard: 4/20
OpenDNS: 2/20
YandexDNS: 0/20

 

[goodjohnjr]

Too late for that, 11 links are already dead, but it still is puzzling, that OpenDNS fails so much, since it maintains Phishtank, so it has first hand access to the source. Anyway, it has been like 24 hours, so if the rest did not catch up by now, I would not rely on them for blocking phishing.

Cleanbrowsing: 18/20
Quad9: 17/20
Neustar: 12/20
Adguard: 4/20
OpenDNS: 2/20
YandexDNS: 0/20

Thank you very much @TairikuOkami , I see that Quad9 did better against phishing, I wonder how is that Cleanbrowsing DNS does so good compared to most DNS services?

I had never heard of Cleanbrowsing DNS before until I saw it mentioned here at the forums, and somehow it is outdoing more popular larger more established better funded better supported DNS services when it comes to malicious/grayware website blocking; if they would add ad-blocking that would be great, and then I would not even think about Adguard DNS.

-John Jr

 

[Burrito]

Just keep in mind, the above tests are focused on phishing. For some in the MT community, phishing is not the most important issue. Both internally (@Evjl's Rain DNS malware tests) and externally (I previously just searched around the net) -- it seems to me that Neustar is pretty good with malware. But this test result loosely correlates with Evjl's Rain's test results for both phishing and malware -- just in case there was any doubt about the testing.

Here is one web result from April 19. It's not a big test, so take it with a grain of salt.

 

[oldschool]

Just keep in mind, the above tests are focused on phishing.

@Evjl's Rain earlier post was re: malware links test. Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

 

[ebocious]

Just keep in mind, the above tests are focused on phishing. For some in the MT community, phishing is not the most important issue. Both internally (@Evjl's Rain DNS malware tests) and externally (I previously just searched around the net) -- it seems to me that Neustar is pretty good with malware. But this test result loosely correlates with Evjl's Rain's test results for both phishing and malware -- just in case there was any doubt about the testing.

Here is one web result from April 19. It's not a big test, so take it with a grain of salt.

View attachment 224578

I wouldn't rely too heavily on DNS to protect my machines from malware. Most malware infections come from legitimate sites anyway, and DNS will not block them just because they've been compromised. If you whitelist NYT and it gets hacked again, it can infect you all day and night, and your DNS won't stop you from visiting because it's whitelisted. Anti-malware browser extensions, however, are designed to catch malware no matter where it comes from.

That said, your DNS service doesn't have to be your only defense against malicious sites. Anti-malware extensions and site-rating tools can help complement your DNS server's blacklist, and then the detection capabilities of the anti-malware extensions themselves will serve as your next line of defense in the event the blacklist fails you. I should say, however, it is encouraging to know that CleanBrowsing caught 83% of phishing sites. That along with WoT and MBBG should just about cover it!