The Download Blog

Retailers aren't the only ones gearing up for the holiday season. Criminals are also out in force.

To highlight the increased crime during the holidays, security company McAfee has come up with the "12 Scams of Christmas" ranging from bogus electronic greeting cards that deliver malware instead of cheer to fake charities that steal your money and your identity.

It's especially important to be extra careful this time of year, says McAfee's David Marcus. "The bad guys know people are spending more time online, they're paying more bills online so [the criminals] stand a chance of being a bit more successful this time of year.

In a podcast interview (scroll down to listen), Marcus counted down the 12 scams of Christmas starting with:

1. Charitable phishing scams: Marcus warns consumers to be wary of e-mails that appear to be from legitimate charities. Not only will they take your money and deprive charities of needed funds, but they will also steal your credit card information and identity.


2. Fake invoices from delivery services: During this period, scammers will send out fake invoices and delivery notifications appearing to come from Federal Express, UPS, the U.S. Postal Service or even the U.S. Customs Service saying that they were unable to deliver a package to your address. They ask you to confirm your address and give them credit card information to pay for delivery.


3. Social networking friend requests: Bad guys take advantage of this social time of year by sending out authentic looking friend requests via e-mail. Marcus recommends that you not click on those links but sign into Facebook and other services and look for friend requests from the site itself. Clicking on a link could install malware on your computer or trick you into revealing your password.


4. Holiday e-cards: Be careful before clicking on a holiday e-card, especially if it's from a site you haven't heard of. This is a way to deliver malware, pop-ups, and other forms of unwanted advertising. Some fake e-cards will look like they come from Hallmark or other legitimate companies, so pay close attention and make sure it's from someone you know. If you're going to send an e-card, be sure you're dealing with a reputable service lest you risk infecting yourself and your friends.


5. Fake "luxury" jewelry: If you see an offer for luxury gifts from companies like Cartier, Gucci, and Tag Heuer at a price that's too good to be true, it probably isn't true. These links could lead you to malware and take your money or merchandise that will probably never arrive (or be fake if it does). Some of these sites, according to McAfee, even display the logos of the Better Business Bureau.


6. Practice safe holiday shopping. Make sure your wireless network is secure and be sure you're shopping on sites that are secure. Though it isn't an iron clad guarantee, you should look for the lock icon in the lower right corner of your browser and make sure the Web page starts with https. The "s" stands for "secure."


7. Christmas carol lyrics can be dangerous: Bad guys know that people are searching for holiday related sites for music, holiday graphics, and other festive media. During this time, they create fraudulent holiday related sites.


8. Job search related scams: With the unemployment rate at 10.2 percent, there are plenty of job seekers looking for work. Beware of online offers for high paying jobs or at-home money making schemes. Some of these sites ask for money up front, which is a good way for criminals not only to steal your "set up fee" but misuse your credit card too. Marcus said that some "get rich quick" sites are all about money laundering, asking you to accept an inbound financial transfer and pay them.


9. Auction site fraud: McAfee has observed a rise in fake auction sites during the holidays. Make sure you're actually going to eBay or whatever site you plan to deal with.


10. Password stealing scams: Criminals use low-cost tools to uncover passwords, in some cases planting key logger software to record keystrokes. Once they get your passwords, they gain access to bank accounts and credit card accounts and send spam from your e-mail accounts.


11. E-mail banking scams: A common type of phishing scam is sending out official looking e-mails that appear to come from your bank. Don't click on any links but type in your bank's Web address manually if you need to access your account.


12. Files for ransom: Hackers use malware to gain control of your computer and lock your data files. To access your own data you have to pay them ransom.

Listen to Larry's interview with McAfee's David Marcus

Listen now: Download today's podcast

MOUNTAIN VIEW, Calif.--For almost all of its existence, Mozilla Messaging has been known for Thunderbird--e-mail software with the traditional view that a person's PC is the center of their computing existence.

Now, though, the Mozilla Foundation subsidiary's scope is expanding beyond the confines of the computer under your desk or on your lap. In the near term, the new Thunderbird 3 is becoming more integrated with the Web. And in the longer term, the Raindrop project has the potential to lift your inbox all the way to the cloud.

"For us it's really important to have Thunderbird. It's also important to not stay in the blinders of that scenario," Mozilla Messaging CEO David Ascher said in an interview at the company's headquarters here. With Raindrop, "We're focusing on best experience for messaging in a Web application."

Mozilla Messaging CEO David Ascher

(Credit: Stephen Shankland/CNET)

The change reflects the changing nature of computing. Where Thunderbird's chief competition once was now software such as Microsoft's Outlook, it's now also got to reckon with Google's Web-based Gmail service and its ilk, Ascher said.

Thunderbird is still a priority. Thunderbird 3 is set to arrive next week in near-final form--though nearly a year later than had been planned--but Mozilla Messaging has high hopes the new version will be faster, easier to use, and more versatile through the addition of third-party extensions.

Universal inbox
Raindrop is something of an ultimate inbox in the company's vision, a Web application that draws not just from e-mail but from other communication conduits such as Twitter, Facebook mail, and instant messaging. Its goal isn't just to consolidate today's overabundance of communications channels, it's to help prioritize what's important and put off what's optional until a more convenient time.

"We're breaking the notion of one list coming in, in chronological order," he said. What just arrived isn't necessarily the most important thing to do, though human minds are prone to thinking it is.

Some aspects of Raindrop's future are more certain than others. It's way to early to say when the company might release its first version of the actual software, but one thing that's settled is that Raindrop won't be a service Mozilla offers. Instead, the software will run on others' servers--at Internet service providers, for example.

"Hosting a messaging system for the world is not something we can afford right now," Ascher said. Still, it's revealing that the company chose to create Raindrop as a server-based technology accessible through a Web browser rather than as PC-based software.

Will Raindrop rule the roost?
In the longer term--say 2015--might Raindrop replace Thunderbird as people's messaging interface of choice? Perhaps.

"I suspect some people will and some people won't," he said. "I think desktop software still has a bunch of user benefits that will last for quite awhile."

Persuading everybody to freely cooperate with Raindrop could be tough. Sites like Facebook like their central positions in people's electronic lives and like to serve ads next to their content. In time, though, Ascher believes they'll come aboard.

"I think in the long term, openness wins," he said.

Even without Raindrop, Thunderbird 3 will integrate with the Web. It's got Firefox's engine built in for displaying Web pages, a fact that means the software can display Web content.

That ability means Thunderbird can, for example, show Yahoo and Google calendars in separate tabs. There's little in the way of integration with those services today, but it can be added, Ascher said. He expects plenty more add-ons will bring it closer to the cloud, too. He didn't mention it, but even Raindrop could be added in its own compartment.

Mozilla Messaging smells money
Mozilla Messaging is part of a peculiar organizational structure. In the beginning the non-profit Mozilla Foundation oversaw the open-source software that was the core of Netscape Communicator. Eventually, that software split into two main components: the Firefox browser and the Thunderbird e-mail software.

The foundation set up two subsidiaries to oversee the two projects, first Mozilla Corp. for Firefox in 2005 and second Mozilla Messaging for Thunderbird in 2007. Ascher has since 2007 led the latter, which employs six engineers and nine others.

It also draws on the expertise of many volunteers in the open-source world who translate the software, write add-ons, and help debug it. Because of this help, Mozilla Messaging gets by with only one quality assurance employee and one marketing employee, and Thunderbird 3 will arrive in more than 40 languages.

The subsidiary today gets its funding from its nonprofit Mozilla Foundation parent, which in turn receives the lion's share of revenue from search advertising revenue that results from searches Firefox sends Google's way. Ultimately, Ascher wants Mozilla Messaging to be financially self-sustaining. But how?

"I'm not sure yet. I think what we're looking for are rev models like Firefox--revenue models where the user benefits and doesn't have to pay anything, and somehow enough money flows into Mozilla Messaging to fund development long-term," Ascher said.

That may sound like a lot of hand-waving, but Ascher points out he has no investors looking for a big and quick return on the money they invested, so Mozilla Messaging is a relatively cheap operation to run.

Ads? No thanks
One route the company won't take is advertising, the approach that's vital to Gmail, Hotmail, and Yahoo Mail, as well as to Firefox.

"I don't think people benefit from advertising in mail," he said. "One reason it works for search engines is people often are searching to buy. They're happy to see ads. It helps them. I don't think that works in e-mail."

Today, there are probably somewhere between 10 million and 20 million Thunderbird users, said Rafael Ebron, Mozilla Messaging's director of marketing. That's a far cry from Firefox, whose users total more than 300 million, Mozilla says.

But both projects can punch above their weight. Just being a freely available alternative--whether with Thunderbird or with Raindrop--can steer other products and services, Ascher believes.

"Firefox had an influence over people greater than its market share," Ascher said. "I don't think we'd need to manage everybody's e-mail servers for us to have an influence over the e-mail landscape and make sure everybody has a better experience."

MOUNTAIN VIEW, Calif.--Thunderbird 3, an update to the e-mail software that Mozilla hopes will give it some of the advantages its Firefox browser has enjoyed, is due to arrive in near-final form next week.

Mozilla Messaging plans to issue release candidate 1 of Thunderbird 3 as soon as Monday, with the final version expected later in November, the e-mail-focused subsidiary of the Mozilla Foundation said Thursday.

"We're down to the last few bugs," said Chief Executive David Ascher. "Feedback with the last beta was enthusiastic." Thunderbird 3 beta 4 can be downloaded for Windows, Mac, and Linux.

Mozilla Messaging CEO David Ascher

(Credit: Stephen Shankland/CNET)

Thunderbird doesn't get as much attention as Firefox, the chief product of the Mozilla Foundation's other subsidiary. But with Thunderbird 3, Ascher and Mozilla Messaging are trying harder to take advantage of one technology that's helped the browser's fortunes: add-ons. They could be written for Thunderbird 2, but only with what Ascher termed an act of heroism; Thunderbird 3 makes add-ons much easier.

One area where add-ons show up is a new Thunderbird 3 feature, Google and Yahoo calendar functions in the software--using its built-in Firefox engine for handling Web pages, naturally.

"There are a bunch of actions that start in e-mail that really involve the Web," Ascher said. Another example he said Mozilla Messaging will write if some enterprising person doesn't do it first: an add-on to help people assess whether to follow a particular Twitter user who just signed up to follow you.

Another add-on that's already under way is Lightning, which parallels Outlook's calendar functions. A Thunderbird 3-compatible version should arrive about the same time, he said. Ultimately, Thunderbird should be able to integrate with either Lightning or Web-based calendars, including the automation of operations such as accepting event invitations.

Better search
The add-ons also dovetail with a significant new Thunderbird feature, improved search. With Thunderbird 2's folder-based search approach, people often didn't set up searches so they could find what they needed. With Thunderbird 3, it returns all results that match the text, not just what's in a particular folder.

"It's really important to search everywhere," Ascher said. As with Google, "You type a word, and you get results."

Of course that can retrieve a lot of unwanted results. So the search results page offers a variety of ways to winnow that search down--limiting it to particular people, to messages with a specific tag, or to a particular time frame selected from a timeline that presents messages using the search term.

These functions to refine the search, which Mozilla Messaging calls "facets," are another area where add-ons can help, Ascher said.

Also coming in Thunderbird 3 is a simpler start-up process. The software is set up in advance to automatically set up the increasingly complicated server configuration for various accounts. I tried it with Gmail, and it indeed was up and running in moments after I entered only my name, e-mail address, and password. The software comes with several profiles built in, and it makes intelligent guesses if it doesn't know, but people will be able to write their own modules that can be shared, too.

Another feature in the new version is the archive, a feature borrowed from Google's Gmail that's a kind of digital purgatory. E-mails sent to the archive are still available through search, but they don't clutter up the inbox. Folders are still available for those who want to file messages the traditional way.

"The original idea of e-mail, putting messages in folders one by one, was reasonable when we got ten messages a day. Now that we get a couple hundred or more, that's a huge burden," Ascher said. "We made archive really easy and complemented it with (an) easy-to-use search experience.

Streamlined interface
One big interface change is the addition of tabs. Mail accounts, folders, and individual messages can show as new tabs rather than new windows. It's one of a number of efforts to provide a more streamlined interface.

One other is moving some message-specific operations to the message window--reply, reply to a mailing list, forward, archive, and other options. Another: the main toolbar has been cleaned up so only essential actions show, though others can be added through customization. And people can be added to the address book with a single click of a star next to their names--not unlike Firefox 3.5's one-click bookmark operation.

Some routine tasks--labeling a message as junk, for example--are designed to be faster, he added.

"If you look at the number of seconds saved over the population of Thunderbird users, it tends to be several lifetimes per year," Ascher said.

One new feature in Thunderbird 3 is a simplified account setup. You enter three bits of information, and Thunderbird often can take it from there.

(Credit: Screenshot by Stephen Shankland/CNET)

A new variant of the Bredolab Trojan horse is attached to a fake "Facebook Password Reset Confirmation" e-mail, security firm MX Labs is reporting.

Some users are receiving the e-mail from "The Facebook Team," according to the security firm. The sender's e-mail address displays "service@facebook.com." In reality, the address and sender were spoofed.

MX Labs found that the e-mail was accompanied by an attachment named, "Facebook_Password_4cf91.zip and includes the file Facebook_Password_4cf91.exe" that, the e-mail claims, contains the user's new Facebook password. The security firm said that the element between the underscore and .zip are randomly chosen letters and numbers for each recipient.

When a user downloads the file, it could wreak havoc on their computer. MX Labs said in a blog post that the Trojan horse Bredolab "executes files from the Internet, such as rogue anti-spyware. To bypass firewalls, it injects its own code into legitimate processes svchost.exe and explorer.exe. Bredolab contains anti-sandbox code (the trojan might quit itself when an external program investigates its actions)." In other words, it's nasty.

Once it makes its way to the user's PC, Bredolab creates "%AppData%\wiaservg.log" and "%Programs%\Startup\isqsys32.exe" in the user's system files. MX Labs said that it also creates two new processes, called "isqsys32.exe" and "svchost.exe."

Another security watchdog, M86 Security, wrote that there's more to the outbreak than Bredolab. After it sneaks its way onto the user's computer, M86 said, Bredolab downloads a bot called Pushdo. The company found that Pushdo immediately starts "spamming out more of these Facebook password reset e-mails."

For its part, Facebook was quick to point out that the e-mail containing the virus wasn't coming from the social network.

"This virus is being distributed through email, not on Facebook," a Facebook spokesperson wrote. "The email is disguised as a Facebook password reset e-mail with an attachment that purportedly contains the new password, but is actually the virus. We're educating users on how to detect this through the Facebook Security Page."

Facebook said that users should be "suspicious of unexpected emails claiming to be from Facebook." The company also said that it will never send users a new password as an attachment.

Those users that have downloaded the file should use anti-malware software to remove it. Click here for a list of security software available from CNET's Download database.

Updated at 1:03 p.m. PDT to include new details from M86 Security.

Mozilla's Thunderbird team has been working on software called Raindrop that aims to unify communications channels such as e-mail, Facebook, and Twitter into a single interface with enough built-in smarts to separate the important messages from the routine.

"E-mail used to house the bulk of the conversations that took place on the internet, but that's no longer the case today. In today's world people use a combination of Twitter, IM, Skype, Facebook, Google Docs, e-mail, etc., to communicate. For many of us this means that we have to keep an eye on an ever-growing number of places we might get new messages," the Raindrop developers said in a blog post about the technology. "We hope to lead and spur the development of extensible applications that help users easily and enjoyably manage their conversations, notifications, and messages across a variety of online services."

A key part of the effort will be to spotlight messages that are important.

"Raindrop intelligently separates the personal messages from the bulk," said developer Bryan Clark. Among other things, it will automatically recognize messages from e-mail lists and from sources such as Facebook or Amazon that send numerous updates, filing them accordingly.

Given Mozilla's two main projects, Firefox and Thunderbird, there's one particular interesting aspect to Raindrop: It's a Web application, not downloadable software. "Our flagship applications will be built entirely for any modern web browser that supports Open Web technologies," the developers said. However, the group expects to support front-end software, including applications for mobile devices, that can use the Web-based service.

The vision has been knocking around Mozilla for some time. David Ascher said in a 2007 interview as he was taking over as chief executive of the Mozilla Messaging subsidiary, "People end up subscribing to more and more channels of communications. It makes it hard to keep track of what's going on if they have to check six different inboxes, search across a variety of systems." He said the group wanted to address the issue.

Outlook, Thunderbird, and Yahoo Mail put Gmail and Hotmail to shame in one important area: handling attachments. Moving e-mail-attached files to a folder on your PC is a breeze in Outlook, Thunderbird, and Yahoo Mail. Doing the same in Gmail and Hotmail? Forget it!

Freeware strips e-mail attachments in a few clicks
Back in June 2008, I wrote about Kopf Outlook Attachment Remover donationware, which lets you save some or all of the files attached to Outlook messages to your PC or network. The program adds a button to Outlook's menu that opens a single dialog box showing your attachment-removal options.

Kopf Outlook Attachment Remover's single dialog lets you save attachments to a folder outside Outlook.

(Credit: Kopf)

The attachments can be removed from the message or simply copied to a separate folder. You can detach specific types of files, remove files larger than a size you choose, and save images embedded in the body of messages. Other options let you overwrite or rename duplicate files, reproduce subfolders in the target folder, and even return the files you remove to the e-mails they were originally attached to.

You get many of the same options in Mozilla's Thunderbird e-mail program via the AttachmentExtractor donationware. After you download and install the add-on and restart Thunderbird, an AE Extract button is added to Thunderbird's toolbar and an AttachmentExtractor option is added to the program's Tools menu.

Selecting either option opens the add-on's settings, which let you select the target folder, save attachments of certain types or with specific attributes, and auto-extract all attachments or only those meeting specific criteria. You can also delete some or all of the attachments, mark the messages as read, and delete the messages automatically.

The AttachmentExtractor add-on for Mozilla Thunderbird provides several options for handling e-mail attachments.

(Credit: AttachmentExtractor)

Download attachments in Yahoo Mail
It's no secret that Webmail services can't match the features of their desktop counterparts, but when it comes to attachments, Yahoo Mail can teach Gmail and Hotmail a thing or two. While Gmail and Hotmail make it easy to find messages with specific types of attachments via search operators, downloading them once you've found them is another matter.

By comparison, zipping and downloading the files attached to your Yahoo Mail messages takes only a couple of clicks. In Yahoo Mail's Classic interface, click My Attachments in the left pane, select those you want to save, or click Check All to choose them all. Then click the Save to Computer button and choose Zip & Download Files button.

Yahoo Mail's attachment-extraction option makes it easy to save e-mail attachments to your PC.

(Credit: Yahoo)

All the attachments are saved in a single zipped file to your browser's default file-download location. You don't get the many options provided in Outlook Attachment Remover or Thunderbird's AttachmentExtractor add-on, but at least the files are backed up and available on your PC or removable medium. I still haven't figured out how to accomplish the same feat with the attachments in Gmail and Hotmail.

Gmail and Hotmail do let you search for all attachments, and in Gmail you can find files by name or extension. To find all messages with attachments, enter has:attachment in the search box of either Gmail or Hotmail and press Enter. Gmail lets you add filename:*.doc, for example, to find only messages to which a Word .doc file is attached. You'll find a complete list of Gmail search operators on the service's help site.

Unfortunately, once you find the attachments in Gmail and Hotmail, there's not much you can do with them except open them one at a time and forward them to a POP or IMAP account. Then you can detach or otherwise process the attachments using one of the free add-ons described above.

You can also set Gmail to automatically forward messages to a POP or IMAP account. (In Hotmail you can forward automatically only to another Microsoft mail service.) I described how to forward mail from Gmail to Outlook and Thunderbird in a post from December 2007.

This won't help you detach the files already received by your Gmail account because there's no way to forward messages in bulk from Gmail. I realize that such a capability would be a spammer's dream come true, but a feature that lets you detach in bulk the files attached to Gmail messages would be nice.

Updated 5:45 p.m. PDT with more details about e-mail push.

(Credit: Screenshot by Jessica Dolcourt/CNET)

Some of you who have been restlessly awaiting the arrival of Google's official Gmail push solution for mobile phones can relax now. On Tuesday, Google expanded the over-the-air syncing capabilities in its Google Sync service to include Google's e-mail--but only for the iPhone and iPod Touch (version 3.0), and for Windows Mobile phones.

Google Sync began as a beta service to sync Google calendar items and contacts to iPhone, Windows Mobile, and Symbian Series 60 phones. Owners of iPhones, iPod Touches, and Windows Mobile phones can now set it up to include Gmail messages as well.

The phones will receive Google Sync messages through their native e-mail, calendar, and address book apps. Depending on your settings, your phone could vibrate and/or chime to let you know that a new message has come in. Note that Google Sync will not push visual notification boxes to iPhone and iPod Touch interfaces. For that, you'll need third party apps like GPush for iPhone. Instead, it pushes e-mail from the server to the phone, rather than pulls in a list of e-mail messages, a request that the phone's e-mail client makes of the server. Push e-mail is often preferred over "pulled" e-mail for its real-time updates and its lower toll on battery life.

BlackBerry and Nokia Symbian Series 60 users won't have access to pushed Gmail yet, but they can still sync calendar and contact events to the phone's built-in address book and calendar.

To get started, visit m.google.com/sync from your desktop or mobile browser. The step-by-step setup process is best navigated from your computer, and will require you to ultimately configure your phone to sync over the Microsoft Exchange Server.

Related story: Gmail push on iPhone? Meet GPush

Social-storage service Dropio on Thursday announced a partnership with Yahoo Mail to deliver a default application for the e-mail program's users. Dubbed Attach Large Files, Dropio's application will allow Yahoo Mail users to send attachments up to 100 MB in size.

When Yahoo Mail users log on to their accounts, they will now see Dropio's Attach Large Files listing included in the Applications drop-down box, which also features apps from Evite, Flickr, and PayPal, among others. When they click on Dropio's application, they can immediately start sending large files through their e-mail accounts.

The Dropio application isn't available through Yahoo Mail's e-mail composition form. Only when the user clicks on the "Attach Large Files" option will they be brought to a page allowing them to select files from their computer. Once they choose all those files, they can then upload them and compose an e-mail message. The message contains a note at the bottom saying the attachment technology is "powered by Dropio."

Dropio has made its way to Yahoo Mail.

(Credit: Screenshot by Don Reisinger/CNET)

The recipients will then view the e-mail's contents on a unique Dropio page. There, they can leave a comment or download the files to their computer.

Incorporating the Dropio technology marks an improvement for Yahoo. Currently, users of Google's Yahoo Mail rival, Gmail, can attach up to 25MB to their messages. By effectively quadrupling that figure through Dropio's app, Yahoo Mail has another compelling feature to communicate to users.

Dropio was quick to point out that the app it created for Yahoo was based on its open application-programming interface. It hopes that the Yahoo Mail feature will be used as a proof of concept for other developers to find unique ways to use its API.

Dropio's Attach Large Files application is available now for free in the Yahoo Mail Applications listing.

If you're contemplating switching to another e-mail provider, but have been too lazy to do a feature comparison of the competition, there's a new tool that might be of assistance. Aptly named E-mail Service Guide takes more than 100 hosted e-mail providers, and lets you comparison shop by feature.

This is handled gracefully with a search tool that lets you plug in which options you want, like whether the service has POP3 and IMAP (Internet Mail Access Protocol) support, or customer service by phone or e-mail so you can talk to an actual human if something goes wrong.

It can also tell you how much each service will cost, by breaking down its price according to how many months you're planning to use it. This includes things from the fine print like sign-up fees or required contracts, all of which can be simply sorted by column.

Looking for the e-mail provider with the biggest attachment size? This tool lets you sort to see which one is the tops.

(Credit: CNET)

Since the tool is focused on premium services, missing are consumer-grade options like the vanilla version of Gmail, Windows Live Hotmail, and Yahoo Mail. Instead you have providers like Zimbra, GoDaddy, and Rackspace--many of which have service license agreements, multi-user seating, and more generous attachment size limits.

See also: Wikipedia's chart of Web mail providers