Hot Take [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

[Evjl's Rain]

Comparison between browser extensions

Test 29/12
Q&A - [Updated 29/12/2018] Browser extension comparison: Malwares and Phishings

Test 24/11
Q&A - [Updated 24/11/2018] Browser extension comparison: Malwares and Phishings

Test 12/11
Q&A - [Updated 12/11/2018] Browser extension comparison: Malwares and Phishings

Test 7/11
Q&A - [Updated 7/11/2018] Browser extension comparison: Malwares and Phishings

Test 6/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 3/9
Q&A - [Updated 3/9/2018] Browser extension comparison: Malwares and Phishings

Test 2/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Test, quick 1/9
Q&A - [Updated 25/7/2018] Browser extension comparison: Malwares and Phishings

Fun test 25/7/2018
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 24/7/2018 (most comprehensive, as possible)
Q&A - [Updated 24/7/2018] Browser extension comparison: Malwares and Phishings

Updated 19/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 18/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 10/7/2018
Q&A - [Updated 10/7/2018] Browser extension comparison: Malwares and Phishings

Updated 7/6/2018
Q&A - [Updated 7/6/2018] Browser extension comparison: Malwares and Phishings

Updated 3/6/2018
Q&A - [Updated 3/6/18] Browser extension comparison: Malwares and Phishings

Updated 25/4/2018
Poll - [Updated 25/4/18] Browser extension comparison: Malwares and Phishings

Update: 23/3/2018
Poll - [Updated 23/3/18] Browser extension comparison: Malwares and Phishings


Browser: Google Chrome 65 x64
Malware and phishing links: 10 malc0de, 10 vxvault, 10 openphish, 10 verified phishtank, 10 unverified phishtank
Total: 50 links

Spoiler: Links

Dropbox - link test 17-3-2018.txt

Extensions: recently downloaded from Chrome Web Store
- Google Safe Browsing (built-in chrome's protection)
- AdGuard AdBlocker: default settings, uses Google Safe Browsing (delayed) and their own database
- Avira browser safety: default settings
- Norton Safe Web: default settings
- Bitdefender Trafficlight: default settings, it rarely blocks any malware links, just old ones
- Avast Online Security: default settings, only has phishing protection, expected to score 0 against malwares
- Netcraft Extension: default settings, only has phishing protection, expected to score 0 against malwares
- uBlock Origin with some additional filters

Spoiler: ublock origin filters

http://hosts-file.net/emd.txt
http://hosts-file.net/exp.txt
http://hosts-file.net/pup.txt
http://hosts-file.net/psh.txt
https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts
https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_IPBL.txt
https://ransomwaretracker.abuse.ch/downloads/RW_URLBL.txt

NOTE: the result can vary from day-to-day. Tomorrow with different links, the result can be very different. All are live links but they can be dead a few minutes after the test. No duplication

Results:

Winner: Google Safe Browsing

 

[Virtuoso]

How are these extensions going to work after Chrome MV3 is enabled? No more dynamic list changes and have to wait till full extension update for any change in the list.

 

[silversurfer]

It been over a year since you did this test so could you please do a new test and add Emsisoft Browser Security extension to your list of extensions to test.

I will try considering that once in the near future...

 

[Vitali Ortzi]

How are these extensions going to work after Chrome MV3 is enabled? No more dynamic list changes and have to wait till full extension update for any change in the list.

No because they send the url , scripts of the page to their servers to check them in real time
Rather then keeping lists in the extension
They don't use any local lists

 

[oldschool]

µBO with The Top Most Abused Top Level Domains list blocks all of the current top listings in Phishtank.

 

[simmerskool]

µBO with The Top Most Abused Top Level Domains list blocks all of the current top listings in Phishtank.

so question (my bad) this is a filter, correct? I opened ubo settings and I do not see it listed, the link goes to github. assuming filter, how do I add it, sorry for being dumb, I'm old and it's monday.

 

[Jonny Quest]

so question (my bad) this is a filter, correct? I opened ubo settings and I do not see it listed, the link goes to github. assuming filter, how do I add it, sorry for being dumb, I'm old and it's monday.

Don't feel to bad, I was wondering the same thing and if I needed to do something on my end.

 

[oldschool]

so question (my bad) this is a filter, correct? I opened ubo settings and I do not see it listed, the link goes to github. assuming filter, how do I add it, sorry for being dumb, I'm old and it's monday.

Use the link to add the filter list to µBO.

 

[simmerskool]

Use the link to add the filter list to µBO.

here in firefox (in linux) the list opens as text file on browser page. so copy it and name it, and add it...???

 

[Gandalf_The_Grey]

here in firefox (in linux) the list opens as text file on browser page. so copy it and name it, and add it...???

Add this as new filter:

https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/spam-tlds-ublock.txt

 

[simmerskool]

Add this as new filter:

https://raw.githubusercontent.com/hagezi/dns-blocklists/main/adblock/spam-tlds-ublock.txt

View attachment 287919

I'm having a senior moment... Do I go to ubo | dashboard | filter lists | import... ? and just paste the link @Gandalf_The_Grey sent?? confused, I am, as it says "one URL per line" but isn't ../spam-tlds-ublock.txt a text list of URLs? I've run ubo as install it, couple clicks, and forget it, and obviously I've forgotten (I also just spent 2 hours studying a language foreign to me and my brain is fried).

 

[Gandalf_The_Grey]

I'm having a senior moment... Do I go to ubo | dashboard | filter lists | import... ? and just paste the link @Gandalf_The_Grey sent?? confused, I am, as it says "one URL per line" but isn't ../spam-tlds-ublock.txt a text list of URLs? I've run ubo as install it, couple clicks, and forget it, and obviously I've forgotten (I also just spent 2 hours studying a language foreign to me and my brain is fried).

Yes, ubo | dashboard | filter lists | import... and just paste the link

 

[simmerskool]

Yes, ubo | dashboard | filter lists | import... and just paste the link

got it!!! too easy, I overthunk it.

 

[Jan Willy]

Interesting all-in-one extension for chromium based browsers to prevent access to phishing- and other malicious sites:

GitHub - OspreyProject/Osprey: Browser extension that protects you from malicious websites.

Browser extension that protects you from malicious websites. - OspreyProject/Osprey

github.com

 

[Azure]

Interesting all-in-one extension for chromium based browsers to prevent access to phishing- and other malicious sites:

GitHub - OspreyProject/Osprey: Browser extension that protects you from malicious websites.

Browser extension that protects you from malicious websites. - OspreyProject/Osprey

github.com

This sounds like herdprotect but for extensions

 

[piquiteco]

Interesting all-in-one extension for chromium based browsers to prevent access to phishing- and other malicious sites:

GitHub - OspreyProject/Osprey: Browser extension that protects you from malicious websites.

Browser extension that protects you from malicious websites. - OspreyProject/Osprey

github.com

Spoiler: Osprey Browser Protection Results

Spoiler

Osprey browser protection extension managed to block 3 test pages phishing, wow that sounds promising.

 

[Zartarra]

Another extension is ScamAdvisor. Sadly it is not available for Firefox.

More informatation at: Download the ScamAdviser App & Browser Extension.

 

[Zartarra]

One word of warning: be careful with extensions that you only can download from GitHub. Do test it first on a testmachine and check the networkconnections.

 

[Vitali Ortzi]

View attachment 288088
View attachment 288089
View attachment 288090

View attachment 288094
[/SPOILER]
Osprey browser protection extension managed to block 3 test pages phishing, wow that sounds promising. [/SPOILER]

one extension to rule them all !

 

[Wrecker4923]

One word of warning: be careful with extensions that you only can download from GitHub. Do test it first on a testmachine and check the networkconnections.

When I saw the Osprey extension above, my impulse was to install it and try it out. But then I paused and thought about a recent article regarding the 35 unknown extensions that aren't searchable on the Chrome Web Store but have been installed 4 million times. I realized this isn't for the faint of heart; I can wait another year or two.

Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs

Even weirder: Why would Google give so many the "Featured" stamp for trustworthiness?

arstechnica.com

 

[Vitali Ortzi]

When I saw the Osprey extension above, my impulse was to install it and try it out. But then I paused and thought about a recent article regarding the 35 unknown extensions that aren't searchable on the Chrome Web Store but have been installed 4 million times. I realized this isn't for the faint of heart; I can wait another year or two.

Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs

Even weirder: Why would Google give so many the "Featured" stamp for trustworthiness?

arstechnica.com

you can manually install it so it wouldn't auto update as at least the current source code doesn't send or connect to anything except url filtering providers that are enabled and it stripes more data then the extensions it replaces did and personally now i use osprey and checkpoint only and they both don't hold pages so performance is light using both