Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Evjl's Rain]

Best combo I found was using
1. NextDNS
2. Edge with Smartscreen
3. Either one of McFee and MalwareBytes (ex equo), followed by Bitdefender and Norton (also ex equo), tu supplement those two.

nextdns is known to get the block list from Google if I'm not mistaken. So 1+2 = chrome (not always updated) and edge (full strength)
similarly, I use Chrome (more updated) + windows defender browser protection (90% power of edge)

other extensions are optional

by the way, I dislike using DNS because their servers are too far from my country -> delay, and it can or cannot unblock links
thank you for your input. It's very true

 

[ForgottenSeer 97327]

@Evjl's Rain NextDNS has a lot more malware protection features (blocking new and parked domains, using AI and other sources besides Google).

How is Quad9 working for you (it uses blacklist sources from reputable security vendors).In terms of phishing/malware protection they are nearly as good (best free DNS-es in terms of protection)

 

[blackice]

I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have
some extensions requires a few seconds delay to work. it means if I open 15 links simultaneously, the extensions would get 0/15. I had to open links 1 by 1 => this might affect the final results because nobody knows the exact delay interval

Spoiler: links

chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15

For chrome is that standard safe browsing or the advanced?

 

[nickstar1]

New Malwarebytes browser guard is in beta and has fine tuned some detection techniques. New malware detection windows no longer reports website blocked due to trojan, reputation etc. it just shows "website blocked due to malicious activity". Malwarebytes Browser Guard Beta for Manifest V3

 

[Evjl's Rain]

For chrome is that standard safe browsing or the advanced?

I used Enhanced Protection
I don't know if it could make any difference

 

[Gandalf_The_Grey]

@Max90 inspired me to test McAfee WebAdvisor: 14/15 (2 were suspicious (orange) instead of risky (red)).

 

[oldschool]

@Max90 inspired me to test McAfee WebAdvisor: 14/15 (2 were suspicious (orange) instead of risky (red)).

Think I've asked this before, does it still require use of search.yahoo?

 

[goodjohnjr]

Think I've asked this before, does it still require use of search.yahoo?

Not the web browser extension at the Microsoft Edge Store that I just installed to see.

 

[pxxb1]

I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have
some extensions requires a few seconds delay to work. it means if I open 15 links simultaneously, the extensions would get 0/15. I had to open links 1 by 1 => this might affect the final results because nobody knows the exact delay interval

Spoiler: links

chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15

What Avast is it; Avast Online Security, the add-on?

 

[nickstar1]

Malwarebytes kicking butt!

 

[Evjl's Rain]

What Avast is it; Avast Online Security, the add-on?

yes it is

 

[pxxb1]

yes it is

Thank you for the vital info.
Since Avast Av is doing so good in tests i thought it was good at web protection also. Obviously not.

 

[Evjl's Rain]

Thank you for the vital info.
Since Avast Av is doing so good in tests i thought it was good at web protection also. Obviously not.

all avast's strength belongs to the AV itself. The extension is just a more updated version to fight against phishing. Avast AV is not up-to-date against phishing

 

[Tiamati]

Maybe we should create a new thread and organize the results. It's getting hard to follow last tests as they are lost in old messages =/

 

[SeriousHoax]

all avast's strength belongs to the AV itself. The extension is just a more updated version to fight against phishing. Avast AV is not up-to-date against phishing

Actually, this is not correct. Avast extension is weak of course but the AV is much stronger against both malicious and phishing sites. The AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.
The extension has some extra features which are unnecessary IMO, but they added the option to auto-hide cookies in the extension after they acquired the "I don't care about cookies" extension.
Edit: Avast & AVG used to redirect users to their extension page the first time a browser was opened after installing the product. But they don't do that anymore.

 

[oldschool]

he AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.

I've always found this to be true, much like Smartscreen.

 

[Zartarra]

Actually, this is not correct. Avast extension is weak of course but the AV is much stronger against both malicious and phishing sites. The AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.
The extension has some extra features which are unnecessary IMO, but they added the option to auto-hide cookies in the extension after they acquired the "I don't care about cookies" extension.
Edit: Avast & AVG used to redirect users to their extension page the first time a browser was opened after installing the product. But they don't do that anymore.

With Trend it is the same. The AV blocks alot more sites compared to the browser extension.

 

[Zartarra]

Last month I tested 5 security products and 5 browser addons against new phising and malwaresites.

Phishing sites:

Mcafee add-on	85.09%
Norton add-on	66.29%
Bitdefender add-on	65.42%
Trend Micro IS	63.81%
Trend Micro add-on	55.90%
Emsisoft	54.06%
F-Secure Safe	50.00%
G-Data IS	49.55%
Malwarebytes add-on	41.18%
Sophos Home Pro	30.53%

Malware sites:

Bitdefender add-on	77.13%
McAfee add-on	71.50%
Malwarebytes add-on	66.52%
G-Data IS	65.18%
Trend Micro IS	62.37%
F-Secure Safe	57.53%
Sophos Home Pro	52.01%
Emsisoft	41.62%
Norton add-on	41.16%
Trend Micro add-on	30.65%

 

[Trident]

Avast extension is weak of course but the AV is much stronger against both malicious and phishing sites. The AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.

That’s right. The in-product blocking abilities (Web Shield) are based on technology that was acquired by AVG from Exploit Prevention Lab. This technology was developed to detect drive-by downloads and other attempts to exploit browser vulnerabilities. In the beginning, it used to scan all sites in real time one by one as they are displayed on Google searches.
This quickly caused outrage and headlines such as this:

AVG scanner blasts internet with fake traffic

You're not that popular after all

www.theregister.com

It was then changed to Just-in-Time (JIT) analysis as users open the website to reduce complaints from web admins.
This analysis is based on heuristics and other data and is more powerful than just using a blacklist as the extension or the mobile products do.

 

[a090]

That’s right. The in-product blocking abilities (Web Shield) are based on technology that was acquired by AVG from Exploit Prevention Lab. This technology was developed to detect drive-by downloads and other attempts to exploit browser vulnerabilities. In the beginning, it used to scan all sites in real time one by one as they are displayed on Google searches.
This quickly caused outrage and headlines such as this:

AVG scanner blasts internet with fake traffic

You're not that popular after all

www.theregister.com

It was then changed to Just-in-Time (JIT) analysis as users open the website to reduce complaints from web admins.
This analysis is based on heuristics and other data and is more powerful than just using a blacklist as the extension or the mobile products do.

This man is just a treasure-trove of good info. Learned things from him about the inner workings of some of these AV companies and their products that I never knew before. And after doing my own research afterwards, everything always checks out to be true.

Keep it up brother.