Feature Request: Link/URL Sanner

[RevivalTech]

Would be really awesome tool to have in the MBToolSet or the extension. Inspiration for it here: https://www.virustotal.com/gui/url/a06a0102b8cec733de99ec8cdfd9395619855dbc343b4c9c22e8ce61c1cf5f13?nocache=1

[Porthos]

1 hour ago, RevivalTech said:

Would be really awesome tool to have in the MBToolSet or the extension. Inspiration for it here: https://www.virustotal.com/gui/url/a06a0102b8cec733de99ec8cdfd9395619855dbc343b4c9c22e8ce61c1cf5f13?nocache=1

I seriously doubt Malwarebytes can compete with Virus total.

[RevivalTech]

lol

7 minutes ago, Porthos said:

I seriously doubt Malwarebytes can compete with Virus total.

lol dang, shots fired eh?! Just me, or aren't they already competing with them? Also, just saying to have a MB style url scanner, with as much as they could offer. This is a idea for a feature add so I don't have to pull up the link for virustotal necessarily, not a recommendation to make the feature significantly better that VT or anything, ya know? Perhaps I don't know how gigantic and hardcore VT is also? have to check them out more in depth...

Edited February 1, 2022 by RevivalTech

[Porthos]

1 minute ago, RevivalTech said:

lol

lol dang, shots fired eh?! 

Virus total has been around forever. It takes a lot  to do what they do.

Most I can ever see MB do is to get added to the web site scanning list like they are with the malware scanner.

 

[RevivalTech]

7 minutes ago, Porthos said:

Virus total has been around forever. It takes a lot  to do what they do.

Most I can ever see MB do is to get added to the web site scanning list like they are with the malware scanner.

 

Gooootcha. Well, perhaps a MB style scanner could be a useful manual tool so you don't have to just "go to it".

Edited February 1, 2022 by RevivalTech

[gonzo]

The scope of the request (and the hidden expectation) would likely be the downfall.  Having the resources for the job onboard and available at all times would make Browser Guard a heavier load on most computers than the browser(s) BG is attached to.  If the resources are there, the user would quickly get tired of clicking links and expect Browser Guard to do it automatically for them.  If they got their wish, they would fall asleep waiting for Browser Guard to get done so they could finally see what they wanted to (assuming senility had not yet settled in).  Besides that, the bad guys are really good at interpreting user behavior and modifying links on the fly via scripting.  You would likely be cursing us and uninstalling it.

[RevivalTech]

On 2/1/2022 at 11:54 AM, gonzo said:

The scope of the request (and the hidden expectation) would likely be the downfall.  Having the resources for the job onboard and available at all times would make Browser Guard a heavier load on most computers than the browser(s) BG is attached to.  If the resources are there, the user would quickly get tired of clicking links and expect Browser Guard to do it automatically for them.  If they got their wish, they would fall asleep waiting for Browser Guard to get done so they could finally see what they wanted to (assuming senility had not yet settled in).  Besides that, the bad guys are really good at interpreting user behavior and modifying links on the fly via scripting.  You would likely be cursing us and uninstalling it.

lol hmmmm idk about all that. Strange negative anti-work responses to this idea lol. I did not expect this type of reaction.... Not sure how it would bloat the extension, would it not be pulling from a main page that hosts the frontend interface, and simply loaded through eh extension window? Also, let's be imaginative! What if the URL scanner in the extension was just an input submission box? No waiting! I find a client or myself with a possible bad link, so I simply raise mouse to the top right of the window I have open on all computers constantly to access the web browser extension, and I click, paste, bang! In a few minutes I get an email notifying me that the url scan has completed and is ready to show me the report! That'd be pretty lightweight and doable I'd imagine.... lol. Anywho, sounds like this is pretty hard no feature request, understood. Moving right along.... 

 

P.S. Try not to have failure to launch notions worried about being cursed at and uninstalling. What's' the metrics on current malwarebytes installs? Think you're doing pretty well on people keeping and enjoying the software. Unlikely a url scanner taking a little bit of time would full turn the level of user that would know about and thus use such a feature.... Cheers! 🍻

Edited February 3, 2022 by RevivalTech

[gonzo]

Databases behind the scenes would cause bloat, or lookups for every redirect causes delays and networking costs (BG is a free product, so there is a balancing act there).  I can get behind the idea of an on-demand scanner using a submission box.  It serves the user, does not add bloat, and is not cost-prohibitive.  A pop-up results window (rather than email) would prevent added infrastructure costs.  Two other items that have not been mentioned, which I think are worthy.

• The report may be invalid by the time you receive it, due to website changes on target websites, links going up and down, round-robin redirectors, or malware that sneaks in (or gets snuffed).
• Adding more and more features to Browser Guard (the free web extension) would make it compete with our commercial product which protects against all protocols

I am often a devil's advocate.  My own "good" ideas are often not safe when subjected to a second look.  You have proposed a good enhancement.  Keep it up!

[RevivalTech]

On 2/3/2022 at 3:29 PM, gonzo said:

Databases behind the scenes would cause bloat, or lookups for every redirect causes delays and networking costs (BG is a free product, so there is a balancing act there).  I can get behind the idea of an on-demand scanner using a submission box.  It serves the user, does not add bloat, and is not cost-prohibitive.  A pop-up results window (rather than email) would prevent added infrastructure costs.  Two other items that have not been mentioned, which I think are worthy.

• The report may be invalid by the time you receive it, due to website changes on target websites, links going up and down, round-robin redirectors, or malware that sneaks in (or gets snuffed).
• Adding more and more features to Browser Guard (the free web extension) would make it compete with our commercial product which protects against all protocols

I am often a devil's advocate.  My own "good" ideas are often not safe when subjected to a second look.  You have proposed a good enhancement.  Keep it up!

Right right. Perhaps it's a paid unlock feature, yada yada. Could be worked in there somehow as a value add I'm sure. That all said, would certainly make send to have something in TechBench tool set thing. So far that's been super useful for us at our shop, wouldn't mind seeing more little features pop up there! haha

[gonzo]

I agree. TechBench is awesome.  I got a sneak peek before it was introduced to the world. I was amazed. I keep a copy here at all times. I will forward a link to this thread to the TechBench guys.

[AlexSmith]

@RevivalTech I am the Technical Product Manager of the Malwarebytes Toolset and after reviewing the thread I have a follow up question:

Would it be accurate to say you are looking for Malwarebytes to create a utility that does the following?

1. User inputs a URL into a GUI or CLI utility
2. URL is loaded silently and scrapes content for any additional URLs
3. All URLs are analyzed with our Web Protection and Browser Guard databases/engines
4. Output a report of the detected URLs and provide a Good/Bad result for each

If you are looking for something more than that, can you clarify the specifics?

As far as building a "VT clone" goes, I would say that's out of the scope of what we can provide. We participate as a trusted partner with VT already, it wouldn't make sense to make something like it when there is a well-established platform that provides results from us and so many other security vendors.

 

[RevivalTech]

4 minutes ago, AlexSmith said:

@RevivalTech I am the Technical Product Manager of the Malwarebytes Toolset and after reviewing the thread I have a follow up question:

Would it be accurate to say you are looking for Malwarebytes to create a utility that does the following?

1. User inputs a URL into a GUI or CLI utility
2. URL is loaded silently and scrapes content for any additional URLs
3. All URLs are analyzed with our Web Protection and Browser Guard databases/engines
4. Output a report of the detected URLs and provide a Good/Bad result for each

If you are looking for something more than that, can you clarify the specifics?

As far as building a "VT clone" goes, I would say that's out of the scope of what we can provide. We participate as a trusted partner with VT already, it wouldn't make sense to make something like it when there is a well-established platform that provides results from us and so many other security vendors.

 

Yes yes, that is right along the lines that I was thinking! Haven't gotten too specific, just had a client with a sus link, and I couldn't remember VT at first, so when I finally did I thought it would have been handy to have it built into the web guard extension, or now the idea of the toolset perhaps.

Yea, listen to you twos I realize more how large VT is and the comparison to MB. I think I had a opposite perception haha. So I understand now that it wouldn't be a clone, but having something similar within the MB fam of toolsets could be nice value add addition I think. Much appreciated for chiming in! 

[AlexSmith]

1 hour ago, RevivalTech said:

Yes yes, that is right along the lines that I was thinking! Haven't gotten too specific, just had a client with a sus link, and I couldn't remember VT at first, so when I finally did I thought it would have been handy to have it built into the web guard extension, or now the idea of the toolset perhaps.

Yea, listen to you twos I realize more how large VT is and the comparison to MB. I think I had a opposite perception haha. So I understand now that it wouldn't be a clone, but having something similar within the MB fam of toolsets could be nice value add addition I think. Much appreciated for chiming in! 

Thanks for the clarification. I now have a much clearer picture of what you are looking for. Other PMs have already looked at this thread and are in the loop too (in case this should be introduced elsewhere in our product line).

We can't promise anything at this time, but the concept of a URL Scanner in the context you're looking for is something Malwarebytes has been looking at doing. So while it's on our radar, I can't say for sure when we would have this and exactly where it would be accessed from.

In any event, thank you for the feedback and allowing me to pick your brain a bit.