Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Gandalf_The_Grey]

Points scored here for Kaspersky and Netcraft:

Advice Request - HEUR:Trojan-PSW.Script.Generic

Hello, KTS blocks the access to this site "francis-miot.com" because of the detection of "HEUR:Trojan-PSW.Script.Generic". I know this site for many years and I never have any problem, so I think that it could be a false positive. I checked with VT and there is 1 detection {VirusTotal} ; I also...

malwaretips.com

 

[pesus]

I did my own testing. 15 fresh malware serving sites using edge(chromium) browser and browser extensions

edge(chromium)smartscreen/wd browser protection	13/15
symantec norton safe web	7/15
bitdefender trafficlight	15/15
blocksi(default settings)	12/15
avira browser safety	3/15
avast online security	7/15
mcaffe webadvisor	0/15
comodo online security pro	4/15
malwarebytes browser guard	11/15
google safe browsing	12/15

 

[oldschool]

I've done a bit of phishing link testing lately with Smartscreen in Edge and Bitdefender Trafficlight in Brave. Both are top-notch. Honorable mention goes to Adguard DNS, which does a decent supporting job on top of those two.

 

[Digmor Crusher]

BDL seems to work , but does anyone remember when Fabian said that they transmit all the websites you visit in clear text, not encrypted at all? So if Fabian doesn't like it I;m not going there at all.

 

[Threadripper]

BDL seems to work , but does anyone remember when Fabian said that they transmit all the websites you visit in clear text, not encrypted at all? So if Fabian doesn't like it I;m not going there at all.

I'm sure someone will be able to find the post on the Emsisoft Forum but I do have the image saved:

 

[Pat MacKnife]

BDL seems to work , but does anyone remember when Fabian said that they transmit all the websites you visit in clear text, not encrypted at all? So if Fabian doesn't like it I;m not going there at all.

I found a post on Bitdefender forum :

The Bitdefender Expert Community

Join the Bitdefender Expert Community to find answers, exchange ideas and connect with other cybersec savvy people!

forum.bitdefender.com

Bitdefender TrafficLight monitors the HTTP traffic and sends the URL links to our labs for analysis purposes. If you access a malicious website, TrafficLight will detect it and will block it.
The content of a web page is scanned (read), but TrafficLight doesn't collect passwords, phone numbers or credit card information.
Rest assured that Bitdefender monitors data only to protect your computer against malicious attacks. You can find more information about data collection in the End User License Agreement

 

[71Hemi]

Any browser guard extensions that play nice with Netcraft and uBlock?

 

[oldschool]

Any browser guard extensions that play nice with Netcraft and uBlock?

Bitdefender or Windows Defender Browser Protection. Either make a good combo with µBO.

 

[Burrito]

Any browser guard extensions that play nice with Netcraft and uBlock?

You mean uBlock Origin.... right?

Yes, most of them do.

As our uBO expert Oldschool stated, TrafficLight plays with both of them. And it's effective lately.

I slightly prefer MBG -- and it works well with both of them.

On this particular computer I'm on, I'm experimentally running all of them... and more.

But that's overkill. I don't recommend it.

 

[blackice]

You mean uBlock Origin.... right?

Yes, most of them do.

As our uBO expert Oldschool stated, TrafficLight plays with both of them. And it's effective lately.

I slightly prefer MBG -- and it works well with both of them.

On this particular computer I'm on, I'm experimentally running all of them... and more.

But that's overkill. I don't recommend it.

View attachment 230427

Burritos are best when they have extras.

 

[oldschool]

I did some testing with both BDTL and Netcraft and they scored extremely well together. I would use this combo in an otherwise unprotected (by AV) browser for sites that require sensitive user info. Likewise in Edge Chromium I'd use Netcraft + Smartscreen.

See this --> Netcraft protection

 

[71Hemi]

Thanks guys for your recommendations. I'll try BDTL and Netcraft as both Emsisoft Browser Security and Malwarebytes Browser Guard don't play nice with Netcraft. Just curious here, I'm using First Party Isolation extension and questioning if I should have set firefox to "block third party cookies" or "cross-site and social media trackers" in the Options/Privacy and Security. This is the description - First Party Isolation, also known as Cross-Origin Identifier Unlinkability is a concept from the Tor Browser. The idea is to key every source of browser identification with the domain in the URL bar (the first party). This makes all access to identifiers distinct between usage in the website itself and through third-party. Think of it as blocking Third-party cookies, but more exhaustively. Here are Firefox's implementation details about First Party Isolation.

 

[Evjl's Rain]

Thanks guys for your recommendations. I'll try BDTL and Netcraft as both Emsisoft Browser Security and Malwarebytes Browser Guard don't play nice with Netcraft. Just curious here, I'm using First Party Isolation extension and questioning if I should have set firefox to "block third party cookies" or "cross-site and social media trackers" in the Options/Privacy and Security. This is the description - First Party Isolation, also known as Cross-Origin Identifier Unlinkability is a concept from the Tor Browser. The idea is to key every source of browser identification with the domain in the URL bar (the first party). This makes all access to identifiers distinct between usage in the website itself and through third-party. Think of it as blocking Third-party cookies, but more exhaustively. Here are Firefox's implementation details about First Party Isolation.

I really like BDTL and WDBP because they are light and efficient, especially BD
with this combo + google chrome, my AV (WiseVector) has had very little work to do because almost everything was stopped in the browser before they could touch my harddrive
I have been using this combo + ublock for at least 1 year. They've never conflicted

Honestly, I don't like Netcraft because it's only good at blocking phishing (I don't need) and some extra protection modules which I don't really need, too (XSS, malicious scripts,...)

by the way, the more flags you enable, the more issues you could get just because flags are experimental features
I realized recently that "Override software rendering list" and "GPU rasterization " (many people recommend enabling them) made youtube on my chrome much laggier than it used to be in the past (new version of youtube). It seems the new youtube doesn't play nice with these 2 flags. After disabling them, I noticed an immediate boost in youtube responsiveness

your flags might cause unexpected problems. They may be stable in this version of chrome but in the next version, they may not. They can also cause conflicts with extensions

 

[SeriousHoax]

Thanks guys for your recommendations. I'll try BDTL and Netcraft as both Emsisoft Browser Security and Malwarebytes Browser Guard don't play nice with Netcraft. Just curious here, I'm using First Party Isolation extension and questioning if I should have set firefox to "block third party cookies" or "cross-site and social media trackers" in the Options/Privacy and Security. This is the description - First Party Isolation, also known as Cross-Origin Identifier Unlinkability is a concept from the Tor Browser. The idea is to key every source of browser identification with the domain in the URL bar (the first party). This makes all access to identifiers distinct between usage in the website itself and through third-party. Think of it as blocking Third-party cookies, but more exhaustively. Here are Firefox's implementation details about First Party Isolation.

You don't need to use an extension for First Party Isolation. Just enable "privacy.firstparty.isolate" in about:config. I have it enabled and also block all third party cookies and you can do the same if you want. No issues here.

 

[ForgottenSeer 823865]

blocking phishing (I don't need) and some extra protection modules which I don't really need, too (XSS, malicious scripts,...)

Those are exactly what everyone need the most...
Extensions blocking malicious sites are useless, those sites (the really malicious ones) rarely stay more than few hours, the time the extension vendor get the signature, the site is already gone...
However malicious scripts and XSS embedded in compromised legit sites are the most dangerous especially when coupled with fileless malwares.

 

[71Hemi]

Well thanks guys! I just eliminated First Party Isolation, Privacy Possum, Netcraft @ uMatrix. I've been using Pale Moon forever and have been away from all the latest/greatest add-ons as Stale Moon doesn't support anything anymore, so I decided to come back to Firefox as my default browser and to re-acquaint myself with what I've been missing out on. Now that Netcraft is out of the picture what do you think of Emsisoft Browser Security and Bluehell Firewall? I'm just playing with options here for now, but will definitely try BDTL and uBlock.

 

[SeriousHoax]

Privacy Possum, Netcraft @ uMatrix

You eliminated Privacy Possum and uMatrix! Why?

Emsisoft Browser Security and Bluehell Firewall?

Don't know about the latter but BDTL is better than Emsisoft at protection. Emsisoft is better for privacy.

 

[71Hemi]

Thanks Umbra! You gots me thinkin mabie I should re-enable uMatrix with Windows Security config and keep Emsisoft Browser Security with its phishing blocking capilabilities.

I eliminated Privacy Possum cause I've blocked third party cookies in firefox and enabled "privacy.firstparty.isolate" in about:config. As far as uMatrix is concerned I'm looking for a less complicated set up so to speak. So is BDTL very intrusive? Is it a bandwidth hog like WOT was?

 

[SeriousHoax]

I eliminated Privacy Possum cause I've blocked third party cookies in firefox and enabled "privacy.firstparty.isolate" in about:config. As far as uMatrix is concerned I'm looking for a less complicated set up so to speak. So is BDTL very intrusive? Is it a bandwidth hog like WOT was?

uMatrix can be tricky to deal with at first so I understand but keep Privacy Possum. It does more than blocking trackers. Privacy Badger is the one that usually blocks trackers only but Privacy Possum does more. BDTL blocks phishing and malicious links and is very light so you should be fine. It used to block trackers too but I'm not seeing that in the latest version which is good.

 

[LDogg]

However malicious scripts and XSS embedded in compromised legit sites are the most dangerous especially when coupled with fileless malwares.

This is why I use ScriptSafe for every website I visit. There's some sites that can spread malware inside a 1x1 iFramed box as well.

~LDogg