Sears infects customer computers with spyware

A Privacy International Harvard researcher has investigated a piece of "marketing software" from Sears and K-Mart and discovered that it contains incredibly invasive, brutal -- and illegal! -- spyware:

Sears offers members $10, and a chance to win one of several sweepstakes as an extra incentive to join the program.

But in return, a small percentage of members must install extremely invasive software.

According to Googins, the product monitors not only all of the user's Web traffic, but also keeps track of secure sessions such as visits to bank sites, sniffs through email headers, and then sends that information to a ComScore.

Link (Thanks, Virtual Tours!)

(Image: Sears, Mónica, a Creative Commons Attribution-licensed photo from OmarOmar's Flickr stream)

[#1 posted by north , January 3, 2008 7:48 AM]

Hey Sears, why don't you give Sony a call.
Might want to ask them how their whole rootkit thing worked out...

[#2 posted by LB , January 3, 2008 8:18 AM]

God, that picture makes me miss when department stores were supposed to be beautiful...

[#3 posted by Halloween Jack , January 3, 2008 9:11 AM]

I used to feel sort of sorry for Sears and K-Mart, classic American retailers that have had their lunch eaten by the likes of Wal-Mart and Target, but not after reading this. Screw 'em.

[#4 posted by MHotel , January 3, 2008 9:50 AM]

I like the ars article on this:

http://arstechnica.com/news.ars/post/20080102-sears-come-see-the-softer-side-of-spyware.html

Especially this part:

In an update to his original post, Googins noted that Sears actually offers a slightly different privacy policy—via the same URL—to compromised computers versus those that have yet to install the software. "If you access that URL with a machine compromised by the Sears proxy software, you will get the policy with direct language (like 'monitors all Internet behavior'). If you access the policy using an uncompromised system, you will get the toned-down version (like 'provide superior service')," he wrote.

Totally awesome, and highly indicitive of the gulf between 'service provider' and end user. It's not just MPAA/RIAA who are the bad guys, and I'm sure the Sears VP's mindset is "we just want to know why customers are shopping at Amazon (et al) instead of us."

Also, apparently no one on high at Sears Holding has ever had their computer pwnzord by spyware. That's the only reason I can think they would OK this and think customers would not A) eventually find out and B) scream for heads to roll when it hits the Washington Post.

[#5 posted by Cowicide , January 3, 2008 10:49 AM]

AND:

C) REALLY scream for heads to roll when it hits the blog at boingboing.net

[#6 posted by proto , January 3, 2008 11:10 AM]

I just happened to be at Landmark Mall (near Washington DC) for lunch, so I stopped in the Sears store there. Not all of the computers on display had a live net connection, but some of the laptops did (unsecured WiFi near by) -- so I signed them up!

[#7 posted by Rob, Denmark , January 3, 2008 11:52 AM]

Lets see how long it takes, before Sears claim they didn't know exactly how invasive 'ScamSores software' (that'll what they'll say!) is.

[#8 posted by hibiscusroto , January 3, 2008 6:59 PM]

that wasnt very k-smart of them

[#9 posted by Rob , January 3, 2008 7:57 PM]

@Rob,Denmark (#7):

That's not going to fly from some comments I've seen on slashdot. One of the higher up at Sears apparently came from ComScore.

[#10 posted by Merovius , January 4, 2008 8:26 AM]

Here's another one just as nice...bought anything from Sears in, say, the last 30 years or so? Anyone you has access to your name, address and phone number (can anybody say phone book?) can access your purchase history the Sears site managemyhome.com

Link to CA.com blog post:
http://community.ca.com/blogs/securityadvisor/archive/2008/01/03/managemyhome-com-another-privacy-issue-for-sears.aspx

[#11 posted by MHotel , January 4, 2008 12:31 PM]

#10:

Looks like managemyhome.com has pulled the "feature." Or at least I can find it following the directions from that link.

[#12 posted by Ian70 , January 4, 2008 2:22 PM]

What an outrage! This explains why it's been all over the news channels, right? Right?.. Anyone? What do you mean "the traditional media hasn't touched this story"?... Oh, crap.

[#13 posted by Coaster , January 4, 2008 7:20 PM]

I remember being very small, that when my mother took us to Sears, it was special, and we got all dressed up for it. I remember the childrens clothing had a central mannequin stand that never changed poses, and I remember feeling awed at a store that had a whole section just for clothes in my size. I certainly didn't feel special enough to deserve all that lol.

Shopping at Sears used to be a status symbol.