Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[likeastar20]

ControlD blocks it(NRD)

 

[Zartarra]

I quicky tested the URL. It was not blocked by McAfee. Palo Alto gives it as "Category: Newly-Registered-Domain". Only Sophos and Norton gives it as "Suspicious".

 

[Kongo]

SafeToOpen extension blocks it

 

[TairikuOkami]

Yeah i should get nextDNS but the free doesnt fit me

If you enable Cache Boost, the query will last for 5 mins, like DNS Cache in Windows, it can be only annoyance, when trying to unblock something fast.
I got 63k queries for 2 PCs in 2 weeks. I have a separate account (for security/privacy) for android, 2 phones, but even together I never surpass 200k.

 

[CyberTech]

The problem is that NextDNS doesn't block Youtube ads, am i wrong?

 

[tidyloop]

The problem is that NextDNS doesn't block Youtube ads, am i wrong?

I believe that is correct. NextDNS blocks items based on particular domains. With YouTube the videos and ads come from the same domain so you can't block YouTube ads based on domain name/DNS.

 

[Moonhorse]

If you enable Cache Boost, the query will last for 5 mins, like DNS Cache in Windows, it can be only annoyance, when trying to unblock something fast.
I got 63k queries for 2 PCs in 2 weeks. I have a separate account (for security/privacy) for android, 2 phones, but even together I never surpass 200k.

View attachment 279140

I use around 100gt of data / month on my desktop, can this compare somehow to queries? i suppose i only filter browser with nextDNS not anything else


BTw the scam site has taken down

 

[brambedkar59]

If you enable Cache Boost, the query will last for 5 mins, like DNS Cache in Windows, it can be only annoyance, when trying to unblock something fast.
I got 63k queries for 2 PCs in 2 weeks. I have a separate account (for security/privacy) for android, 2 phones, but even together I never surpass 200k.

View attachment 279140

I use NextDNS on a Win11 laptop and 2 Android phones. Still haven't reached limit yet, using for more than a year now. I have enabled cache boost.

 

[toto_10]

Could someone perform a test of browser extensions in a traditional manner, similar to how @Evjl's Rain approached it?

I miss those regularly tests back in the days

 

[LennyFox]

Could someone perform a test of browser extensions in a traditional manner, similar to how @Evjl's Rain approached it?

I miss those regularly tests back in the days

Indeed his latests post is from July 2023. Again a honory member leaving the forum? hope he is well.

 

[silversurfer]

Could someone perform a test of browser extensions in a traditional manner, similar to how @Evjl's Rain approached it?

I miss those regularly tests back in the days

I could try to perform such a test in the near future, malware-links AND phishing?
To all readers from this thread, please mention all browser extensions you would like to see in the test?

 

[Gandalf_The_Grey]

I could try to perform such a test in the near future, malware-links AND phishing?
To all readers from this thread, please mention all browser extensions you would like to see in the test?

That would be great, thanks
My wishlist would be this:

No, extensions, but to see if they are even needed:
Google Safe Browsing (standard/enhanced)
Microsoft SmartScreen

Extensions:
The Gen Digital trio: Avira, Avast and Norton
Bitdefender TrafficLight
Malwarebytes Browser Guard
McAfee WebAdvisor
Microsoft Defender Browser Protection
Netcraft Extension
SafeToOpen Online Security

 

[silversurfer]

That would be great, thanks
My wishlist would be this:

No, extensions, but to see if they are even needed:
Google Safe Browsing (standard/enhanced)
Microsoft SmartScreen

Extensions:
The Gen Digital trio: Avira, Avast and Norton
Bitdefender TrafficLight
Malwarebytes Browser Guard
McAfee WebAdvisor
Microsoft Defender Browser Protection
Netcraft Extension
SafeToOpen Online Security

I have one VM with latest stable build of Windows 11, Edge is pre-installed, so this is the browser for testing.
Regarding Google Safe Browsing, I would need to install Chrome and the whole test need to be done another time against all malware/phishing links. So for the first time, I would just rather testing only with Edge (including MS SmartScreen) and most browser extensions (all 8 from your list, exclude MDBP).

McAfee WebAdvisor has the system-wide installer version from the homepage, I would prefer the browser extension from Edge addon store:

McAfee® WebAdvisor - Microsoft Edge Addons

Make Microsoft Edge your own with extensions that help you personalize the browser and be more productive.

microsoftedge.microsoft.com

 

[Gandalf_The_Grey]

Thanks for the info and I look forward to your test

For me interesting will be to see how SmartScreen will do and if there still is a difference between the Gen Digital products?
And if the move to MV3 will have an impact, for that you could test the beta version of Malwarebytes Browser Guard.

 

[silversurfer]

In my VM, all mentioned extensions are installed on Edge, Malwarebytes BG is twice installed, stable version from Edge store and the beta MV3 from Chrome web store.

Testing will be time consuming for me because turn on/off each extension after another to get the correct test verdict, I will try to add screenshots if blocked by ...

For me interesting will be to see how SmartScreen will do and if there still is a difference between the Gen Digital products?
And if the move to MV3 will have an impact, for that you could test the beta version of Malwarebytes Browser Guard.

I did a very quick test to check the difference between the Gen Digital products:
Avira Browser Safety: 2/2
Avast Online Security: 1/2
Norton Safe Web: 0/2

Note: A lot of other "malicious links" need to be tested for more accurate conclusion, I hope to have enough time for testing on next weekend, at least will try

 

[silversurfer]

Finally, test is done, overall 10 links (5x phishing / 5x malware.exe)

---

​	Phishing ​	Malware ​
Avast Online Security​	4/5​	2/5​
Avira Browser Safety​	4/5​	5/5​
Bitdefender TrafficLight​	5/5​	5/5​
Malwarebytes Browser Guard​	1/5​	5/5​
McAfee WebAdvisor​	5/5​	5/5​
Netcraft Extension​	4/5​	2/5​
Norton Safe Web​	1/5​	3*/5​
SafeToOpen Online Security​	3/5​	5/5​
Microsoft Edge Smart Screen​	3/5​	4*/5​
Google Safe Browsing Enhanced​	3/5​	4*/5​

Norton Safe Web: *blocked while downloading
All other Browser Extensions either displayed a warning or blocked access to the link(s)

Microsoft Edge Smart Screen: *blocked while downloading or blocked access to the link
Google Safe Browsing Enhanced: *blocked while downloading or blocked access to the link

Note: Malwarebytes Browser Guard AND Malwarebytes Browser Guard MV3 Beta, no difference of detection

 

[ErzCrz]

Nice one @silversurfer Looks like BD Traffic Light still really effective! Appreciate you taking the time for testing

 

[Gandalf_The_Grey]

Thanks for this test @silversurfer

To answer the questions I had before:
Based on this test Chrome and Edge performed the same.

Extra security extensions are not really needed, but can help to protect you a little more.
Personally I like the safe or not safe indicators on Google or Bing searches.

Avira performed the best of the Gen Digital trio and also did great in the latest test of @Shadowra .

The move to MV3 will probably not have an impact on the performance of these extensions, seeing the results of Malwarebytes.
Malwarebytes and SafeToOpen did both disappoint a little.

Best of this test are Bitdefender and McAfee.

I will keep the Bitdefender TrafficLight extension installed as I find it more polished than McAfee WebAdvisor.

 

[oldschool]

The move to MV3 will probably not have an impact on the performance of these extensions, seeing the results of Malwarebytes.

I'll add that Smartscreen and SafeBrowsing will probably possibly maintain an advantage in real time detection.

Malwarebytes and SafeToOpen did both disappoint a little.

Indeed. But to state the obvious, we should remember this is just one test.

 

[Gandalf_The_Grey]

I'll add that Smartscreen and SafeBrowsing will probably possibly maintain an advantage in real time detection.

Indeed. But to state the obvious, we should remember this is just one test.

The only thing is that people need to use Edge or Chrome to get the best out of SmartScreen and Safe Browsing.
With other browsers you can get no or a delayed protection.
Not sure how, for example, Brave uses Google Safe Browsing

And yes this is only one test.