Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Moonhorse]

Is there any way to get frontline page of phishing blocked by av vendors?

This is frontline page as example

It redirects you to random sites wich will be either, surveys like you won an iphone, you have post waiting as example
Sometimes its fake dating site or something too good to be true
Goal of these sites is money trapping, i dont know wich is the real word for it but you pay 1€for something like iphone, but in reality you have joined to random dating site wich will bill you 30€ every month until you close your card

Frontline page stays up forever, but the scam sites problably will get flagged ...but when taking a look at this example i believe its been going for a year without any blocking by av vendors

I just wanted to report that site to vendors like microsoft, netcraft as i did but they wont flag frontline pages as they are not malicious

 

[upnorth]

@Moonhorse , because of the adult content that site redirects to I had to remove the link. It's a too big risk people that shouldn't test ( minors ), still do.

But I understand your point. Extra so when one starts to check Whois records and are faced with " Not Disclosed! " on registrant information. Seems these people wants to cover their tracks, but if you search a bit you will find some connections to a company in Cyprus. I haven't searched more.

 

[Moonhorse]

@Moonhorse , because of the adult content that site redirects to I had to remove the link. It's a too big risk people that shouldn't test ( minors ), still do.

But I understand your point. Extra so when one starts to check Whois records and are faced with " Not Disclosed! " on registrant information. Seems these people wants to cover their tracks, but if you search a bit you will find some connections to a company in Cyprus. I haven't searched more.

Sorry, it will redirect to bunch of sites, but thats why i posted a VT url so people wont go that far but i understand

Such companies do bill money from people but dont exist , they dont have office and the dating sites they have just wont work at all, its shady stuff and i just want to report such sites as they are spam on some forum/chanlikes i visit sometimes

With registering to VT i can find a lot but its just wasted time to go throught all sites, when we could just blacklist frontline page

 

[upnorth]

Sorry, it will redirect to bunch of sites, but thats why i posted a VT url so people wont go that far but i understand

Such companies do bill money from people but dont exist , they dont have office and the dating sites they have just wont work at all, its shady stuff and i just want to report such sites as they are spam on some forum/chanlikes i visit sometimes

With registering to VT i can find a lot but its just wasted time to go throught all sites, when we could just blacklist frontline page

2 ways of report that I personal found from time to time effective, and that I highly recommend you test. But please be aware, that this can take time and is not always a fail safe method.

• Submit the url/link to several major AV companies/vendors. Also include a bit extra information, like screenshots, AnyRun result etc. You want these vendors to notice the actual issue. More included information, is better then less. Make sure they can contact you back!
• Report the url/domain to the main registrants abuse department. For example if the domain is registered at GoDaddy. " Registrar Abuse Contact information " at Whois.

Whois godaddy.com

Whois Lookup for godaddy.com

www.whois.com

 

[Zartarra]

Hello

I tested the protection from some AV's against malware- and phishing links. There is a small error margin because some links where dead after a few days. I didn't had time to test all the products on the same day.

​	AVG​	Bitdefender​	Emsisoft​	F-Secure​	Eset​	G Data​	Kaspersky​	Sophos​
Malwarelinks (1100 links)​	81,09%​	92,82%​	43,36%​	86,45%​	89,09%​	89,55%​	73,55%​	84,73%​
Malwarelinks: downloaded samples detected (signatures and ML)​	40%​	68,75%​	89%​	68%​	11,11%​	50%​	56,52%​	1,43%​
Phising links 1 (1000 links)​	97,64%​	84,47%​	51,4%​	97,58%​	58,95%​	73,52%​	88,84%​	84,11%​
Phising links 2 (1500 links)​	98,07%​	95,6%​	93,53%​	92,67%​	99,2%​	46,62%​	94,6%​	94,73%​

If you count all the results the top 3 is: F-secure, Bitdefender and AVG.

If you count the link detection, the top 3 is: AVG , F-Secure and Bitdefender.

The best download detection rate top 3 is: Emsisoft, Bitdefender and F-secure.

 

[Kuttz]

Phishing links 1 and Phishing links 2 ESET performance variance was quite high what could be the reason ? I was evaluating between BitDefender and ESET and found everything convincing except the inconsistency in ESET Phishing detection performance. Great nonetheless

 

[Zartarra]

Phishing links 1 and Phishing links 2 ESET performance variance was quite high what could be the reason ? I was evaluating between BitDefender and ESET and found everything convincing except the inconsistency in ESET Phishing detection performance. Great nonetheless

The first phishing links were links from January, link collection 2 from June. Don't know what the reason is but I have a simular result with Emsisoft and G Data.

 

[oldschool]

I've done some informal testing of phishing links today and Emsisoft does pretty good. I only tested BD Trafficlight and Emsi.

 

[goodjohnjr]

I've done some informal testing of phishing links today and Emsisoft does pretty good. I only tested BD Trafficlight and Emsi.

How did Bitdefender Trafficlight do in comparison?

 

[oldschool]

How did Bitdefender Trafficlight do in comparison?

It always does well. It's of a favorite of many MT members. I just prefer Emsisoft because it's more private.

 

[goodjohnjr]

It always does well. It's of a favorite of many MT members. I just prefer Emsisoft because it's more private.

Yep, I was just wondering if it was still performing better than Emsisoft.

 

[oldschool]

Yep, I was just wondering if it was still performing better than Emsisoft.

They were pretty even, but only tested about 2 dozen links and I didn't keep an exact tally.

 

[goodjohnjr]

They were pretty even, but only tested about 2 dozen links and I didn't keep an exact tally.

Okay, interesting, thank you for answering that.

 

[Evjl's Rain]

I did a test today with 25 links from urlhaus

Spoiler: Links

malware links 7/10/2021 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

Google safebrowsing
- Enhanced: 23/25
- Standard: 22/25
- Bypass non-HTTPS message: 22/25
EDIT: forgot to count the true blocks = really detected as malwares

Avira Browser Safety: 19/25

Emsisoft: 21/25

Malwarebytes: 24/25
- Default: 24/25
- Malwares + PUPs + Scam only: 24/25
- Malwares + PUPs only: missed a lot

Microsoft Defender Browser Protection:
- Warns: 20/25
- Blocks: 18/25 (2 links were warned as unsafe but still downloaded)

Norton Safe Web: 14/25 (1 dead link, 10 files downloaded)

Bitdefender Traffilight: 1/25 !!! (re-tested several times, different methods)

Bonus:
Wisevector Web Protection: 17/25

p/s: I don't have MS Edge on my laptop. Please someone test and report if you have time

 

[Andrew3000]

I did a test today with 25 links from urlhaus

Spoiler: Links

malware links 7/10/2021 - Pastebin.com

Pastebin.com is the number one paste tool since 2002. Pastebin is a website where you can store text online for a set period of time.

pastebin.com

Google safebrowsing
- Enhanced: 23/25
- Standard: 22/25
- Bypass non-HTTPS message: 22/25

Avira Browser Safety: 19/25

Emsisoft: 21/25

Malwarebytes: 24/25
- Default: 24/25
- Malwares + PUPs + Scam only: 24/25
- Malwares + PUPs only: missed a lot

Microsoft Defender Browser Protection:
- Warns: 20/25
- Blocks: 18/25 (2 links were warned as unsafe but still downloaded)

Norton Safe Web: 14/25 (1 dead link, 10 files downloaded)

Bitdefender Traffilight: 1/25 !!! (re-tested several times, different methods)

Bonus:
Wisevector Web Protection: 17/25

p/s: I don't have MS Edge on my laptop. Please someone test and report if you have time

Fast test with Avast One, Kaspersky and Webroot (don't count dead links).
Avast One = 1 miss (mtz_ami_vyber.exe)
Webroot = 2 miss (mtz_ami_vyber.exe and 1005_2457398972604.doc)
Kaspersky = 1 miss (mtz_ami_vyber.exe)

Edit: Added Kaspersky.
Also tested again Avast. Now it takes all the links.

 

[Gandalf_The_Grey]

MS Edge blocked 19/25
The missed 6 (1, 13, 15, 18, 24 and 25) were intercepted by Ziggo Safe Online (F-Secure safe).
Ziggo Safe Online (F-Secure Safe) blocked 23/23 (2 dead links (17 and 21) when testing again with Edge SmartScreen disabled).
AdGuard phishing- en malware-protection blocked 0/25

Edit: added Ziggo Safe Online and AdGuard results.

 

[Evjl's Rain]

maybe, I made a mistake that makes google safe browsing detected so many
I found links with my main browser with safebrowsing enabled. During that time, it might collect enough info and blocked the links
next time, I will turn off safebrowsing before finding links

something is deeply wrong with bitdefender today. Re-tested, it only detected 4 links

 

[ForgottenSeer 92963]

QUAD9 and Next DNS also did very poorly. Probably because the IP-addresses don't need to be resolved.

'Trend Micro in the router' did very well (by the time I tested, 8 links were dead) Trend-Micro only missed two.
One was caught by Next DNS and the other one was intercepted by Microsoft Defender (the doc download).


PS. I also had to disable one site permission in Edge Chromium otherwise 23 links would NOT have started the download.

 

[Evjl's Rain]

QUAD9 and Next DNS also did very poorly. Probably because the IP-addresses don't need to be resolved.

'Trend Micro in the router' did very well (by the time I tested, 8 links were dead) Trend-Micro only missed two.
One was caught by Next DNS and the other one was intercepted by Microsoft Defender (the doc download).


PS. I also had to disable one site permission in Edge Chromium otherwise 23 links would NOT have started the download.
View attachment 261077

true. Most malwares are delivered via http, not https. Blocking http will prevent most malwares
google chrome also warns about this and prevents http downloads to start. Links must be accepted manually and most people won't accept or they don't know how to accept

 

[Jan Willy]

Next DNS also did very poorly

AFAIK does NextDNS use Google Safe Browsing (with some delay in updates). In post #1474 GSB scored very well. Strange.