Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Moonhorse]

So i was searching for tobaccos, came up with this VirusTotal

Spoiler

Their twitter account banned

Is this somekind of malware site? First on google results.

Also can someone take a look on this site VirusTotal

AVG finds cardstealer from the forum..

 

[oldschool]

Also can someone take a look on this site VirusTotal

AVG finds cardstealer from the forum..

Why don't you check it with NetCraft extension?

 

[Moonhorse]

Why don't you check it with NetCraft extension?

Netcraft doesnt find anything about it . I submitted that site to AVG already if theres fp

 

[Evjl's Rain]

@Evjl's Rain Can you find the time to do an up to date test?

I hope so. However, I don't have any good source left to find malware links. They are all dead or restricted
phishing links are easy to find but it's not super important

 

[Gandalf_The_Grey]

I hope so. However, I don't have any good source left to find malware links. They are all dead or restricted
phishing links are easy to find but it's not super important

As far as I know the only one left is URLhaus.
Maybe other members can advise?

 

[silversurfer]

As far as I know the only one left is URLhaus.
Maybe other members can advise?

Yes, I can recommend searching there on URLhaus, type exe and after that click on Search then you find malware links as exe what usually does work...
NOTE: just make sure to check always for Status: Online

 

[Gandalf_The_Grey]

Yes, I can recommend searching there on URLhaus, type exe and after that click on Search then you find malware links as exe what usually does work...
NOTE: just make sure to check always for Status: Online

View attachment 271115

You can also download an URLhaus database dump (Plain-Text) containing only online (active) malware URLs:

URLhaus | API

URLhaus is a project operated by abuse.ch with the purpose of sharing malicious URLs that are being used for malware distribution

urlhaus.abuse.ch

The Plain-Text URL List gets generated every 5 minutes. Please do not fetch it more often than every 5 minutes.

 

[HarborFront]

Can try to download malware from here

1) theZoo - A Live Malware Repository

GitHub - ytisf/theZoo: A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.

A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public. - ytisf/theZoo

github.com

2) VirusShare.com

3) Malware URL

Here's a list of more malware sites. Many likely to be dead

hxxps://www.reddit.com/r/Malware/comments/7fabu5/sites_to_download_malware/

 

[goodjohnjr]

Does anyone else think that Norton Safe Web has possibly improved recently since all of Norton's acquisitions of other security companies?

It would be nice to see an updated malicious, phishing, and grayware (adware, PUPS, et cetera) website test against: Norton Safe Web, McAfee SiteAdvisor, Malwarebytes Browser Guard, Bitdefender TrafficLight, Emisisoft Browser Safety, Avira Browser Safety / Avira Safe Shopping, AVG Online Security, Avast Online Security & Privacy, AdGuard / uBlock Origin with Security Settings & Security Lists enabled.

 

[Evjl's Rain]

when I have time, I will try to do a test if I can collect a good number of links

 

[goodjohnjr]

when I have time, I will try to do a test if I can collect a good number of links

Cool! Thank you, Evjl's Rain, I look forward to it.

 

[Evjl's Rain]

I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have
some extensions requires a few seconds delay to work. it means if I open 15 links simultaneously, the extensions would get 0/15. I had to open links 1 by 1 => this might affect the final results because nobody knows the exact delay interval

Spoiler: links

chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15

 

[Gandalf_The_Grey]

I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have

Spoiler: links

chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15

Thanks, for testing
Edge: 8/15 (and 1 warning for a not often downloaded file (Ace.exe)).
After downloading Ace.exe it is noticed by Microsoft Defender and recommended to quarantine or remove.
All zip and rar files go through.

 

[goodjohnjr]

Thanks, for testing
Edge: 8/15 (and 1 warning for a not often downloaded file (Ace.exe)).
After downloading Ace.exe it is noticed by Microsoft Defender and recommended to quarantine or remove.
All zip and rar files go through.

Interesting, thanks, did you have the Security setting Block Potentially Unwanted Apps enabled?

If not, I would be curious if it does any better with that setting enabled.

I think that they should have that enabled on default.

 

[goodjohnjr]

I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have
some extensions requires a few seconds delay to work. it means if I open 15 links simultaneously, the extensions would get 0/15. I had to open links 1 by 1 => this might affect the final results because nobody knows the exact delay interval

Spoiler: links

chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15

Thank you very much, I guess Norton has improved, AdGuard & Emsisoft Browser Guard are still disappointing, and Malwabytes Browser Guard & Bitdefender TrafficLight are still at the top.

 

[Gandalf_The_Grey]

Yes

Interesting, thanks, did you have the Security setting Block Potentially Unwanted Apps enabled?

If not, I would be curious if it does any better with that setting enabled.

I think that they should have that enabled on default.

Yes, that was enabled and didn't make a difference.

 

[ForgottenSeer 97327]

Remember I tested a few of those extensions for weeks (link)

Best combo I found was using
1. NextDNS
2. Edge with Smartscreen
3. Either one of McFee and MalwareBytes (ex equo), followed by Bitdefender and Norton (also ex equo), tu supplement those two.

After intensifying my testing between Julian date Christmas and Gregorian date Christmas (I was working abroad and had nothing to do in the evenings) I noticed only the moment of testing made a difference. Apparently when those extensions updated their (cloud) data bases one of those top 4 (McFee, MBAM, Bitdefender, Norton) had a little advantage over the other.

Noticeable in all this testing Edge Smartscreen blocked around 25 to 30 percent and NextDNS from 30 to 35 percent. The remainder (usually 35 to 40 percent) was blocked by the top four.

I had also tested Avast, Avira and Phishtank, but dropped them after the first round of testing. They may have blocked more, but their sources seemed to overlap with NextDNS (DNS blocks kick in earlier than extensions blocks) and Edge Smartscreen (I disabled extension and repeated test with DNS and Edge only, to get an impression of their 'added blocking value').

My conclusion: When you use a DNS with URL filter and a browser with a decent URL filter, using easy medium mode or easy hard mode protection in your adblocker (e.g.@Jan Willy for AG or @ErzCrz for uBlockOrigin) makes the added value of just another URL blocking extension minimal (like @cruelsister often states). That is why I opted for easy medium in uBlockOrigin now (but I tend to switch between AdGuard and uBO for as long as it lasts) with NO URL blocking extension

 

[goodjohnjr]

Yes

Yes, that was enabled and didn't make a difference.

Thank you Gandalf_The_Grey.

 

[Evjl's Rain]

Thank you very much, I guess Norton has improved, and AdGuard still disappoints; but Malwabytes Browser Guard & Bitdefender TrafficLight are still at the top.

I don't know about norton because its results vary a lot. Sometimes, it's on top, sometimes, it's close the bottom.
the ones with good form are Bitdefender, malwarebytes, chrome and edge, avira sometimes

 

[goodjohnjr]

I don't know about norton because its results vary a lot. Sometimes, it's on top, sometimes, it's close the bottom.
the ones with good form are Bitdefender, malwarebytes, chrome and edge, avira sometimes

Yep, I know Norton was doing bad for a while, while those others usually did better & were more consistent; so I never considered it a possible contender until recently.