Finjan Secure Browsing ???

[OSCIVWAR]

Good morning,

As I understand it, TWITTER has problems with links leading to malicious sites. I happened to discover a program (Finjan Secure Browsing) that scans all links shown on TWITTER and then indicates whether they are safe (or not).

Is anyone familiar with this program? I learned about it on a blog at Download.com.

Comments and advice most welcome.

Thanks.

[OSCIVWAR]

Here is a link to the FINJAN website --- http://www.finjan.com/SecureTweets/securetweets.html

[MrAlanCaboose]

Hi,

I've been using Finjan for a few weeks now, and it has never alerted me to any bad links or such. I'll be happy to keep testing a while longer though.

[js9600]

Well so does Mcafee, Norten, Trend, WOT, Browserdefender and what else there is. At least if you ask them for reason to be alive... Get a better chance of evaluating your self by decoding those tinyurl type links. You can use this Greasemonkey script http://userscripts.org/scripts/show/40582 Extensions does the same and this mighty Twitter script has this as a sub-feature http://userscripts.org/scripts/show/40617 You do the clicking so might as well know what can be expected. Will remove most dangers just by looking at url. At least the obvious ones.

If still scared of not being able to see through weird links, and still with the intention of clicking, I would rely more on paid Malwarebytes, IP blocking, and perhaps additional hosts blocking through Hostsman. Twitter is about the moment so what matters is what works in real time, or almost. Have not tried Finjan but from what I have tested the only service that works somewhat effectively is WOT. 4-5 months ago up popped a phsihing site asking for Twitter logins. Few minutes/hours later it was on Mashable and other "aware" sites. Warning, warning. And WOT had it blocked, marked "RED" within hours. Site went down and since then 100s of similar problems have been serviced by our internet. No way any scanner can figure that out. Only humans/real intelligence so what is updated first wins. I have gigantic reservations towards WOTs setup, "social"= anti-security in my eyes, but as long as object is a black/white situation it works very well. Actually you can test that by right now by digging up some lists over malware domains. Chances are Trend, Norten, Finjan, Avira and other AVs http scanners have no clue while WOT is updated in attempted realtime This also partly why this forum even exit. Security is often "security". WOT might be Malwarebytes of domain blocking.... If Norton and friends did what it says on front page Malwarebytes would live for 1 month, max. Some claim to do "active" scanning of content like malicious scripts, AVG for example. Well so they say. WOTs value can certainly be proven in few minutes. Easy to promise, harder to deliver. Just great if Finjan is answer to all problems - having tired most of these tools I think more waste of time. In other words "code analysis" my butt Dumb domain blocking at least works.

[js9600]

I assumed you are familiar with Firefox. Could be you only use IE8 so no use of extension/userscripts dealing with Twitter urls. Don't know of any IE8 tricks to fix this problem. I would rather see the real url for myself than rely on Finjan or whatever to diagnose "code". Safe code can be bad enough! Firefox can give you a see-through experience on Twitter and if you are afraid of clicking urls from your new subscirber who follow 999 others and have almost no following "her" (typically "her" to attract most audience/clickers) then fixing this is important. You learn to evaluate links instead of just blindly clicking.

[mountaintree16]

Please see here everyone:

http://www.malwarebytes.org/forums/index.p...st&p=143719

This tool should be helpful

[YoKenny1]

Please see here everyone:

http://www.malwarebytes.org/forums/index.p...st&p=143719

This tool should be helpful

It says at the end

I installed it yesterday. Removed it about an hour later, and that was a chore in itself.

http://www.malwarebytes.org/forums/index.p...st&p=176182

[mountaintree16]

@ YoKenny1

You can just use the URL that Falkra provides That was my main point when posting the link. No installation of anything there

I do see your point though, and I think that the OSCIVWAR probably meant LinkScanner, not the Firefox add-on, but I am not positive.

http://www.malwarebytes.org/forums/index.p...st&p=175238

Personally, I just don't click those types of links anyway unless it comes from Malwarebytes or a Malwarebytes staff member

[js9600]

Remember those tiny links are all over the internet. Twitter is just an obvious place to spam them. They are of course extremely useful due to limitations of post length. Nothing evil in tinyurl and friends. Some work with WOT I believe, the most popular one is Bit.ly? Well here is their policy and hints to "obfuscated" links.

Bit.ly filters all links through several independent services to check for spam, suspected phishing scams, malware, and other objectionable content. We currently include Google Safe Browsing, SURBL, and SpamCop in our operations. For Firefox and Chrome browser users, we also have a Preview Plugin that allows you to view more information about a link before clicking. If you are a Twitter user, similar preview features are offered by Tweetdeck (we

[mountaintree16]

Thanks for the additional information, js9600

[js9600]

Pic show what I expected from Finjan compared to WOT that is. Not saying it does not work, just limited.

[mountaintree16]

js9600,

Is the green check on the left from Finjan? The red in the right is from WOT, correct?

[js9600]

Yep. I just did a Google search for the ever popular "registry fix", "registry boost" also works.

http://securebrowsing.finjan.com/help.html shows how it works. Green means Finjas has scanned site and found it to be safe = no evil code. Which might be correct but then again is not. Might be a good companion to WOT since they position them self against "other products" with their outdated static databases

[mountaintree16]

Ah, I see.

Thanks for the clarification I don't use any of those currently, but I have been considering using one.

[js9600]

Is interesting to see how much crap you get from doing a simple Google search that is for sure. Questionable products/sites know their SEO.

Anyway, I know there are people who insist on "proactively" scanning of javascript, not to mention NoScript. If there are hidden redirecting iframe I would guess Finjan picks them up. Whole internet is evil and you are under attack idea. Others might have more faith in browsers. That segment of concerned internet users might be interested in this "Unlike other products" thing. Another "layer of protection", just in case and it make so much sense. Must then remember that now it works, oops now it does not WOT, and Malwarebytes IP blocking, is dumb as a door, they are correct about that. But if you only set up WOT to deal with red sites, ignore anything but red, then value seems a lot higher than whatever scanning Finjan does. There are problems with WOT vs. spamming/false positives - less with red sites. More of a notification tool when site is yellow or even half-red. "Let us discuss" is also part of WOT. The part I dont like but that is me... Finjan has on on/off approach since they rely on "scanner". Safe, not safe, not scanned are only options.

WOTs plugin lets you use it as you wish. Many options, blocking/warning according to category/rating for example. Very flexible and way more usable I think. Unless someone make a real test showing how Finjan kick butt compared to the old way I think also much more added security.

[YoKenny1]

I would trust WOT this time:

http://hosts-file.net/?s=www.registryfix.com <== EMD - sites engaged in malware distribution

[js9600]

Oh yeah and some of those links will give work to Malwarebytes If you read on Finjans about page you see they say "innovative real-time content inspection" but they forget to mention limitations of their own stuff. I would rather rely on http scanner in Antivirus program, most have them already and Finjans product seems to work much the same way. Then add Malwarebytes IP blocking, WOT, updated hosts file via Hostsmanager or whatever is considered useful.

[OSCIVWAR]

Oh yeah and some of those links will give work to Malwarebytes If you read on Finjans about page you see they say "innovative real-time content inspection" but they forget to mention limitations of their own stuff. I would rather rely on http scanner in Antivirus program, most have them already and Finjans product seems to work much the same way. Then add Malwarebytes IP blocking, WOT, updated hosts file via Hostsmanager or whatever is considered useful.

I guess it boils down to "pick yer poison!"

[OSCIVWAR]

Anyway, thanks to all for an interesting discussion.