Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Evjl's Rain

Level 47
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Malware Hunter
Apr 18, 2016
3,684
Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings


Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings


Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings


Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings


Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings


Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings


Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings


Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings


Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings


Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings


Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings


Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings


Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings


Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings


Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings


Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings


Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings



Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links
Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:
result.png


Winner: Google Safe Browsing
 
Last edited:

Evjl's Rain

Level 47
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Malware Hunter
Apr 18, 2016
3,684
Best combo I found was using
1. NextDNS
2. Edge with Smartscreen
3. Either one of McFee and MalwareBytes (ex equo), followed by Bitdefender and Norton (also ex equo), tu supplement those two.
nextdns is known to get the block list from Google if I'm not mistaken. So 1+2 = chrome (not always updated) and edge (full strength)
similarly, I use Chrome (more updated) + windows defender browser protection (90% power of edge)

other extensions are optional

by the way, I dislike using DNS because their servers are too far from my country -> delay, and it can or cannot unblock links
thank you for your input. It's very true
 
F

ForgottenSeer 97327

@Evjl's Rain NextDNS has a lot more malware protection features (blocking new and parked domains, using AI and other sources besides Google).

How is Quad9 working for you (it uses blacklist sources from reputable security vendors).In terms of phishing/malware protection they are nearly as good (best free DNS-es in terms of protection)
 
Last edited by a moderator:

blackice

Level 38
Verified
Top Poster
Well-known
Apr 1, 2019
2,731
I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have
some extensions requires a few seconds delay to work. it means if I open 15 links simultaneously, the extensions would get 0/15. I had to open links 1 by 1 => this might affect the final results because nobody knows the exact delay interval


chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15

For chrome is that standard safe browsing or the advanced?
 

pxxb1

Level 9
Verified
Well-known
Jan 17, 2018
436
I'm back with some links. Some of them are rar, zip files -> more difficult. It's hard to find new links
sorry, I don't have Edge and McAfee Webadvisor because I don't want to install them
sophos requires enrollment. I don't have
some extensions requires a few seconds delay to work. it means if I open 15 links simultaneously, the extensions would get 0/15. I had to open links 1 by 1 => this might affect the final results because nobody knows the exact delay interval


chrome: 10/15
adguard: 4/15 (needs a few seconds delay between each link)
avira: 12/15
emsisoft: 4/15 (needs a few seconds delay between each link)
malwarebytes: 13/15
WDBP: 8/15 (needs a few seconds delay between each link)
Norton: 11/15
bitdefender: 14/15 (needs a few seconds delay between each link)

avast (only blocks phishing): 2/15
ublock (list from URLhaus = unfair): 12/15


What Avast is it; Avast Online Security, the add-on?
 
  • Love
Reactions: nickstar1

Evjl's Rain

Level 47
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Malware Hunter
Apr 18, 2016
3,684
Thank you for the vital info.
Since Avast Av is doing so good in tests i thought it was good at web protection also. Obviously not.
all avast's strength belongs to the AV itself. The extension is just a more updated version to fight against phishing. Avast AV is not up-to-date against phishing
 

SeriousHoax

Level 47
Well-known
Mar 16, 2019
3,630
all avast's strength belongs to the AV itself. The extension is just a more updated version to fight against phishing. Avast AV is not up-to-date against phishing
Actually, this is not correct. Avast extension is weak of course but the AV is much stronger against both malicious and phishing sites. The AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.
The extension has some extra features which are unnecessary IMO, but they added the option to auto-hide cookies in the extension after they acquired the "I don't care about cookies" extension.
Edit: Avast & AVG used to redirect users to their extension page the first time a browser was opened after installing the product. But they don't do that anymore.
 

Zartarra

Level 7
Verified
Well-known
May 9, 2019
312
Actually, this is not correct. Avast extension is weak of course but the AV is much stronger against both malicious and phishing sites. The AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.
The extension has some extra features which are unnecessary IMO, but they added the option to auto-hide cookies in the extension after they acquired the "I don't care about cookies" extension.
Edit: Avast & AVG used to redirect users to their extension page the first time a browser was opened after installing the product. But they don't do that anymore.
With Trend it is the same. The AV blocks alot more sites compared to the browser extension.
 

Zartarra

Level 7
Verified
Well-known
May 9, 2019
312
Last month I tested 5 security products and 5 browser addons against new phising and malwaresites.

Phishing sites:
Mcafee add-on85.09%
Norton add-on66.29%
Bitdefender add-on65.42%
Trend Micro IS63.81%
Trend Micro add-on55.90%
Emsisoft54.06%
F-Secure Safe50.00%
G-Data IS49.55%
Malwarebytes add-on41.18%
Sophos Home Pro30.53%

Malware sites:
Bitdefender add-on77.13%
McAfee add-on71.50%
Malwarebytes add-on66.52%
G-Data IS65.18%
Trend Micro IS62.37%
F-Secure Safe57.53%
Sophos Home Pro52.01%
Emsisoft41.62%
Norton add-on41.16%
Trend Micro add-on30.65%
 

Trident

Level 27
Verified
Top Poster
Well-known
Feb 7, 2023
1,628
Avast extension is weak of course but the AV is much stronger against both malicious and phishing sites. The AV is always up-to-date on everything and can also detect scripts injected on websites for malicious/phishing attempts that the extension cannot do.
That’s right. The in-product blocking abilities (Web Shield) are based on technology that was acquired by AVG from Exploit Prevention Lab. This technology was developed to detect drive-by downloads and other attempts to exploit browser vulnerabilities. In the beginning, it used to scan all sites in real time one by one as they are displayed on Google searches.
This quickly caused outrage and headlines such as this:

It was then changed to Just-in-Time (JIT) analysis as users open the website to reduce complaints from web admins.
This analysis is based on heuristics and other data and is more powerful than just using a blacklist as the extension or the mobile products do.
 

a090

Level 2
Mar 26, 2023
67
That’s right. The in-product blocking abilities (Web Shield) are based on technology that was acquired by AVG from Exploit Prevention Lab. This technology was developed to detect drive-by downloads and other attempts to exploit browser vulnerabilities. In the beginning, it used to scan all sites in real time one by one as they are displayed on Google searches.
This quickly caused outrage and headlines such as this:

It was then changed to Just-in-Time (JIT) analysis as users open the website to reduce complaints from web admins.
This analysis is based on heuristics and other data and is more powerful than just using a blacklist as the extension or the mobile products do.

This man is just a treasure-trove of good info. Learned things from him about the inner workings of some of these AV companies and their products that I never knew before. And after doing my own research afterwards, everything always checks out to be true.

Keep it up brother.
 

Nikos751

Level 20
Verified
Malware Tester
Feb 1, 2013
969
Last month I tested 5 security products and 5 browser addons against new phising and malwaresites.

Phishing sites:
Mcafee add-on85.09%
Norton add-on66.29%
Bitdefender add-on65.42%
Trend Micro IS63.81%
Trend Micro add-on55.90%
Emsisoft54.06%
F-Secure Safe50.00%
G-Data IS49.55%
Malwarebytes add-on41.18%
Sophos Home Pro30.53%

Malware sites:
Bitdefender add-on77.13%
McAfee add-on71.50%
Malwarebytes add-on66.52%
G-Data IS65.18%
Trend Micro IS62.37%
F-Secure Safe57.53%
Sophos Home Pro52.01%
Emsisoft41.62%
Norton add-on41.16%
Trend Micro add-on30.65%
That’s a great ranking!
Whats noticeable though, is that phishing detection can go downhill for some vendors depending on the region. For example most phishing websites in greek language have poor detection rates from vendors that are pretty good on non region specific websites.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top