SmartScreen (officially called Windows SmartScreen, Windows Defender SmartScreen and SmartScreen Filter in different places) is a cloud-based anti-phishing and anti-malware component included in several Microsoft products, including operating systems Windows 8 and later, the applications Internet Explorer, Microsoft Edge. SmartScreen intelligence is also used in the backend of Microsoft's online services such as the web app Outlook.com and Microsoft Bing search engine.
SmartScreen as a business unit includes the intelligence platform, backend, serving frontend, UX, policy, expert graders, and closed-loop intelligence (including machine learning and statistical techniques) designed to help protect Microsoft customers against safety threats like social engineering and drive-by downloads.
SmartScreen in Internet Explorer
Internet Explorer 7: Phishing Filter
SmartScreen was first introduced in Internet Explorer 7, then known as the Phishing Filter. Phishing Filter does not check every website visited by the user, only those that are known to be suspicious.
Internet Explorer 8: SmartScreen Filter
With the release of Internet Explorer 8, the Phishing Filter was renamed to SmartScreen and extended to include protection from socially engineered malware. Every website and download is checked against a local list of popular legitimate websites; if the site is not listed, the entire address is sent to Microsoft for further checks. If it has been labeled as an impostor or harmful, Internet Explorer 8 will show a screen prompting that the site is reported harmful and shouldn't be visited. From there the user can either visit their homepage, visit the previous site, or continue to the unsafe page. If a user attempts to download a file from a location reported harmful, then the download is cancelled. The effectiveness of SmartScreen filtering has been reported to be superior to socially engineered malware protection in other browsers.
According to Microsoft, the SmartScreen technology used by Internet Explorer 8 was successful against phishing or other malicious sites and in blocking of socially engineered malware.
Beginning with Internet Explorer 8, SmartScreen can be enforced using Group Policy.
Internet Explorer 9: Application Reputation
Building on top of the SmartScreen Filter introduced in Internet Explorer 8, Internet Explorer 9's protection against malware downloads is extended with SmartScreen Application Reputation that detects untrustworthy executables. This warns a person if they are downloading an executable program without a safe reputation, from a site that does not have a safe reputation.
Internet Explorer Mobile 10
Internet Explorer Mobile 10 was the first release of Internet Explorer Mobile to support the SmartScreen Filter.
Microsoft Edge
Microsoft Edge was Microsoft's new browser beginning in Windows 10, originally built on the same Windows web platform powering Internet Explorer, later rebuilt on Google's Chromium browser stack to go cross-platform onto macOS and down-level into Windows 8.1 and below. SmartScreen shipped with each version of Microsoft Edge, mostly with Internet Explorer parity, in progressive versions adding protection improvements targeting new consumer threat classes like tech support scams or adding new enterprise configurability features.
Addressed criticisms
In October 2017, criticisms regarding URL submission methods were addressed with the creation of the Report unsafe site URL submission page. Prior to 2017, Microsoft required a user to visit a potentially dangerous website to use the in-browser reporting tool, potentially exposing users to dangerous web content. In 2017, Microsoft reversed that policy by adding the URL submission page, allowing a user to submit an arbitrary URL without having to visit the website.
SmartScreen Filter in Microsoft Outlook was previously bypassable due to a data gap in Internet Explorer. Some phishing attacks use a phishing email linking to a front-end URL unknown to Microsoft; clicking this URL in the inbox opens the URL in Internet Explorer; the loaded website then, using client-side or server-side redirections, redirects the user to the malicious site. In the original implementation of SmartScreen, the "Report this website" option in Internet Explorer only reported the currently-open page (the final URL in the redirect chain); the original referrer URL in the phishing attack was not reported to Microsoft and remained accessible. This was mitigated beginning in early versions of Microsoft Edge by sending the full redirection chain to Microsoft for further analysis.