Sears Installs Spyware
Gandalf_the_Beardy writes in with news that's been around a while but is getting more attention lately. Last month Benjamin Googins, a security researcher at CA, determined that Sears Holding Corp. installed ComScore spyware without adequate disclosure. Sears said, yes we tell people about tracking their browsing. On Jan. 1 spyware researcher Ben Edelman weighed in, noting that Sears' notice occurs on page 10 of a 54-page privacy statement, and twits Sears because its installation identifies the software as "VoiceFive" and later claims it's coming from a company called "TMRG, Inc." even though a packet sniffer confirms the software belongs to ComScore, adding "These confusing name-changes fit the trend among spyware vendors."
My dad worked for Sears as an appliance repair tech for 25+ years. The stories he's told me about their tracking their employees, their customer "service" practices, sales approaches, etc... is just plain wrong. He was constantly intimidated by "the boss" to perform better or he would be fired (even though he was the top performing tech in the area). It was nothing but stress for him and I wish he had never worked for them.
Now he works for a small appliance/TV repair shop, and he absolutely loves it. Just another reason to flip the bird to big corporations - they don't care about people, they care about money. The spyware installation on their own customers' computer systems is just one small example.
It is pitch black. You are likely to be eaten by a grue.
I would love to meet the decision maker that believes this is morally permissive act that can be "contracted" through an EULA.
In my opinion this is worse than the "communities" some e-com sites have you join that secretly charge your card $2 a month, at least that you see on your CC statement. Also, does it put anything visible in your Programs folder or does this program show up in Add/Remove Programs?
//TODO: Insert catchy phrase
I worked for Sears years ago, and this does not surprise me one bit. They are an evil company that will stop at nothing to make a buck. Oh, and do you want me to put that on your Sears card?
Not only will we track where you browse on our website which has legitimate marketing value for us; we will also break into your computer without your knowledge and track every other website you visit. You are not safe within your own home.... muahahahah.... I mean we do this to PROTECT your privacy. We will not give out this information unless we get your consent or we get a good enough offer for the data. Anything over one cent per one thousand records consitutes a good offer. We do not disclose offers for data purchase so pretty much you have to assume we are giving your browsing habit data away. We also do this to PROTECT your privacy. Thank you for choosing Sears.
This is the least expensive install Sears has ever done for me!
What does SEARS need with this info? Honestly, this just smells bad. I won't call them evil just yet but this is pretty serious from a privacy POV.
Also, isn't it about time we push for a law that makes these privacy agreements shorter and in english (not legalese). One thing I like about CC is that they have a layman's terms version of all their licenses as well as the legalese ones. Not only would people be more likely to read them but it makes it hard for companies to bury important info several pages deep.
I realize that the layman's version would be long as heck but it's better then nothing (and people would STILL be more likely to read it since they can understand it without thinking to hard).
This is a fairly obvious example of what has happened to the concept of "the customer" in the retail space. The old principle of serving the customer still applies, but the identification of the customer has changed. The customers of K-Mart Sears are no longer the people buying products in stores and use the Sears website; the new customer is the stockholder. The people who buy products and use the website are just commodities to be traded like anything else.
Installing spyware on website users? Why not, if the website users are just inventory to be controlled and traded.
This is true not only in retail, but in IT. Do you think the people who actually buy, say, operating systems, are the customers of the software companies that make them? Think again. Their customers are their stockholders too. The purchaser is just a commodity. Maybe companies which commoditize consumers need a wake-up call to remind them that consumers are still the real customers. A PR mess like this sends a bit of a reminder, but the only message that really hits home is one that impacts the EPS.
The customers of K-Mart Sears are no longer the people buying products in stores and use the Sears website; the new customer is the stockholder.
This is true of any publicly traded company. How or what that company does to produce max profits for its shareholders is a different matter...
Don't blame me, I voted for Kodos
Wow! I'm so FLAMING HOT MAD about this, that I would boycott Sears if not for the fact that I never shop there anyway. Are you with me people?! MAKE YOUR VOICES HEARD! Punish Sears by refusing to purchase from them the things you already don't purchase from them!
Today's Sesame Street was brought to you by the number e.
They've been slowly going out of business for years as their clueless
management phases out of retail products and services and whiles away
its days with speculative
investments. Now, maybe they're going into the spyware
or pop-up advertising business to cash in on the dot com
boom. Sears is the poster boy for the pointy-hair boss in
Dilbert.
... that all company officers and directors MUST have installed on every work and home computer the same software that they are installing on everyone else's computers. I'll bet money that none of them have installed this onto their own computers.
They "serve" customers, alright. As in, "To Serve Man".
What we need is Plain English legislation, generally. If a law, contract, or other legal document cannot be understood by a person of average intelligence and reasonable education, it is null and void.
Yeah, I know the lawyers would hate it. Tough.
...laura
StopBadware should hear about this. It's exactly the sort of thing that gets a company a big red X on the StopBadware site. Plus some really bad publicity.
StopBadware is sponsored by Harvard Law School, Oxford University, and Consumers' Union. There's heavy legal firepower available if needed.
...to promote full disclosure, and support those who spot these abuses and expose them.
When the corporations decide that getting caught doing dumb/unethical/improper stuff costs them more than whatever the stuff was going to get them, then this will stop.
Until then, one more corporation to put on my do-not-shop list. For a very long time...
deleting the extra space after periods so i can stay relevant, yeah.
I'd like to see how Sears will produce profits if everyone quits buying their products. As President Truman said, "The buck stops here". Different "buck", but you get the idea.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
We know about that now! And we'll boycott Sears into bankrupcy!
Well, we won't shop there anymore, maybe. But bankrupcy? Hardly. How many people know about that? A hundreth of a percent? Maybe? How many care about it? Even less?
"So Sears tracks my online surfing? So what? I got nothing to hide, and their stuff is so CHEAP!"
That's what you'll hear as the reply of Joe Average. People have not discovered yet that their privacy actually does have some value. Unfortunately, corporations have. Not only a value, they also tacked a price tag to it, too.
Maybe we can play on people's greed and envy. "THEY are making money of something you give them for free! Shouldn't you get something for it, too?" Maybe that's the angle how we can sell privacy...
Holy crap, I sound like a marketing guy. Please shoot me.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Dr. Bruner: Do you feel more relaxed in your favorite K-mart clothes?
Charlie Babbitt: Tell him, Ray.
Raymond Babbitt: K-mart sucks.
Dr. Bruner: I see.
CA's Benjamin Googins is being diplomatic, of course. If the guy in charge of the "community" was previously a senior VP at the spyware company, then he clearly has a vested interest in the continued success of comScore.
If this were happening in a government agency, there would rightly be cries of conflict of interest. So much for the "perfection" of the free market over the ebil gubbermint...
FWIW, I haven't stepped foot in a Sears in about 5 years, when I needed a spark plug socket, and I can't recall my last purchase before that. And I've rarely been in a K-Mart since they closed most of their Texas stores -- the ones in other states still suck just as hard as they did before the buyout, but it's hard to compare one strong vacuum against another.
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
I would ask that all antivirus/anti-malware companies use Sears.ComScore to ID this virus (oops, I mean "service"). Sears will have free advertising in all anti-malware apps just like Sony.Rootkit does!
Then again, Sears' lawyers may request to have it changed to Sears®.ComScore.
Windows 3.1x calc: 3.11 - 3.10 = 0.00
Page 10 of a 54 page document? Sears must be Douglas Adams fans!
This reminds me of the Hitchhiker's Guide to the Galaxy, where it was pointed out that the public plans for the hyperspace bypass were to be found in the bottom drawer of a locked filing cabinet, stuck upside-down, in a disused toilet with a sign on the door saying 'BEWARE OF THE LEOPARD!'
Kind of reminds me of Radio Shack when they required you to give info to make a purchase in other words it sucked.
Why did Sears even set up their own online fanboy forum? And who would even join a circle jerk forum for a department store?
But does the legalese really apply reasonable to those user licensing agreements that say that the site owns your content "throughout the universe". Does the copyright registration apply at the time a signal from earth could arrive at (say) the Small Magellanic Cloud? Or do they (as lawyers) think it applies from "now"? Talk about copyright for a "limited time"!
Not only confusing legaleze, but physics.
A community-oriented lyrics site
Say, where's the Linux installer? What? You mean this is only for windows users? Sweet!
Once I was a four stone apology. Now I am two separate gorillas.
Let me fix that: "we do as little as possible..."
It must have been something you assimilated. . . .
You're like...completely right (in my opinion).
To expand on the economic side a bit, the stock holders own shares of publicly traded companies because they believe those companies will earn profit and grow in the future. Investment is a beautiful but risky thing. A company that no longer maintains the ability to expand and sell more widgets/services will not realize the growth needed to bring a return on the investments. That means a company like Sears always needs to expand and sell more and more stuff in order to compensate for the "interest" that must be paid out to the investors. Basically, investors will pull out if a company can't realize a certain growth in share value, so the company must grow. Hence, it is reasonable for the company to try and push spyware on to products they sell, because it opens them up to a new customer base--advertising companies willing to pay to gain access to marketing information people's computers. Companies who's cash is 'borrowed' from investors will always face this problem. They can't afford not to grow.
Do I lay blame to these "evil" companies for trying to screw over the consumer? Some of it is their fault, but I tend to also (read: not entirely) lay blame the consumer for making spam, spyware, rootkits, etc. profitable. Just as companies have an ethical code we more or less hold them to, consumers also must take responsibility and understand that their choices also effect change in the marketplace.
I really like supporting companies like Google and Whole Foods whose management teams profess to see value in giving back to the community. I also respect individuals who understand that the only way large, evil companies can seem to rule the world is if the majority of a society tolerate them. And if the majority of the society is not willing to tolerate these companies, then they won't buy the crapware filled computers, and no laws are needed. If the majority of the society is willing to tolerate these companies, than "Democracy" has failed.
Basically, I find that a society that needs huge amounts of laws above and beyond basic things like anti-trust in order to keep corporations in check will end up having a bunch of citizens who can't make responsible decisions for themselves. That means that such a society cannot support a democracy. Scary thought to me.
Slashdot: Where people pretend to be twice as smart as they really are by behaving like children.
I kind of see it both ways. Everyone expects a company to understand its customers, and to keep up with customer trends. Even when those trends include "people are pirating music because they don't want to pay for it" or "people in Singapore are pirating software because the licensing is too expensive." ...yet no one wants their purchasing behaviors tracked, employee activities mined, etc. Employers want the freedom to be creative with the information retrieved so that they can more easily change with the market, employees and customers want any information they provide to be at least anonymous and preferably full disclosure on how the information is used.
...but just where do you draw the line?
Since I'm developing product requirements, that kind of information si very useful to me. A market research company gathers it and my department buys the research so that we can develop better products. Most of the information gathered is from people who have volunteered to share how the product is used. Try getting a software pirate to do that! So how do you gather data that's truly unbiased? I'm not a hypocrite... you'll find a lot of information about me online; yet I share the same concerns about identity theft as everyone else. Just what piece of personal information can be used to identify me vs. an imposter if everything the imposter needs can be learned from a spock.com, MySpace, or facebook profile?
Sears' spyware idea is extreme by any measure. There are less intrusive ways of gathering data about potential business opportunities. Referring URL tags, for example. Gathering data from the outside about who visited from a sears domain address as another.
Did anyone bother to ask the customers what they want?
From TFA:
Every website visitor that joins the Sears community installs software that acts as a proxy to every web transaction made on the compromised computer.
Wait a second...this so-called "privacy breach" requires a user to sign up, give away personal information, and download and install software?
Oh, the horror!
Give...me...a...freaking...BREAK! Whining and bitching because someone is too lazy to read a 54-page privacy document? Intimidated by such a beast? Then DON'T INSTALL THE SOFTWARE!
If there ever was a story that needed to be tagged "nothing to see here, move along," this is it. When will the public wake up and figure out that they expose themselves to nefarious evil-whoring overloads whenever they download and install unknown software from the Internet?
And now with this story, maybe it's time to stop even trying. (I had a minor loyalty to Kmart because I'm originally from their part of the country; and to Sears because the Craftsman guarantee policy is good.)
"with their freedom lost all virtue lose" - Milton
wow. At the risk of being redundant, off-topic and overrated, I should say that I have never seen more insightful comment on modern economy at /.
Good job.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
What the hell is Sears thinking? Didn't they learning anything from Sony's rootkit fiasco? This is a complete outrage. Look at the type of people who normally shop at sears. It's demographic is older women who I would guess are not normally tech-savvy or aware of online security issues. This stinks like rotten fish and I hope the word gets out. Bad Sears, BAD!
I'll vote for the first presidential candidate who specifically cites this as behavior that should result in dissolution of Sears Holdings - the loss of its status as a corporate "person" and the sale of its assets to fund future government enforcement against such blatant abuses of basic American and human rights by other corporations. Perhaps current laws won't allow justice in this case, but it wouldn't take long to change that. This is behavior that clearly calls for (1) jail time for the top executives - 10 year minimum, and (2) the end-of-life of the corporation committing the atrocity.
"with their freedom lost all virtue lose" - Milton
A properly configured router and a proxy server are all anyone needs for this.
Why bother installing spyware to track web usage if you control the network?
http://www.dieblinkenlights.com
...of that eclectic and somewhat, ahem, "unruly" segment of the on-line community that uses phrases like, "Big Fucks Fly Out To..." I would dearly love to see the internet cleansed of Sears' presence the same way you'd fumigate your house to get rid of cockroaches, bedbugs or other loathsome and potentially dangerous pests.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
OMG! It's a freakin' COOK-BOOK!!! #!@94023kd;a^OFF-HOOK
'nuff said. Talk about capitalism gone bad! I hope they get the crap sued out of them over this.
Never sign up for any unnecessary service that requires you to install software, EVER. This is much worse than, say, Yahoo Messenger which installs the toolbar that changes all your settings or...well, I can't reference anything else because that 15 minute annoyance was enough for me to be more cautious than ever with 3rd party software. I used to think Sears was at least "reputable", but this thread has convinced me to stick with Macy's/Nordstroms for clothing (theirs are better anyway), Ikea for furniture/large appliances, OSH/Home Depot/Lowe's for hardware, and Bed Bath & Beyond for beyond.
Not that I ever shopped at Sears in the last 5 years anyway.
On a related topic, if a merchant requires special software for me to purchase from them, I'll just take my business elsewhere.
Charisma is the measure of someone's ability to lie with a straight face.
When I go to the mall I park by Sears because there are no cars there. There is easy access to the mall proper from the Sears entrance. That's about the only use I have for sears anymore. I have used the craftsman lifetime warranty, but only because my tools broke... not sure if that's a positive or negative.
Usually at any respectable company (not that sears is respectable), you would be escorted out of the building by security and not allowed to stand around.
Ok, let me get this straight... buddy wants to join this online community run by Sears Inc.
He browses to the website and runs through the registration.... so far so good.
He then receives an html email with a link which he clicks on (mistake 1), this brings up a website which asks him for personal information (mistake 2) and then offers to send him an executable file to run on his local machine.
He actually downloads and runs it (mistake 3) and then is surprised that it is spyware?
What did he think it was?
a random cool screensaver? some sort of game?
(pssst, here a tip: you don't need to install additional software to access the web)
I'm all for publishing this and giving Sears a corporate image pummelling but you'd have to be born yesterday to actually fall for such a thing.
Oh, and for the love of god; stop clicking on links in emails!
Without going into gruesome detail, I believe Sears is in "The Scam Business". I know, I know - such a large, public (?) company wouldn't pull such shenenagans on such an ongoing basis, would they?
One day I found that may Sears card, which hadn't been used in years was getting charges on it for some "Sears Health Care" insurance plan I never signed up for. Upon calling "Sears" to debate the charge, they refused to remove it from my bill, and I was livid. They told me to "Call the vendor, and debate it with them".
"What?! This is not a regular "Credit-Card", it's my Sears card, you are the vendor." Much to my surprise, despite the recordings that identified themselves as "Sears" when I answered the phone - the people on the phone told me that they were "CitiBank", not "Sears". "Okay" - I thought - so CitiBank bought the credit cards from Sears? This is sort of okay - but I've never heard of a credit card refusing to remove a fraudulent charge. Not only did they do this, but they went as far as to tell me that if "the vendor" did not volintarily remove the charge, I had no recourse.
No...this is too unbelieveable - CitiBank, too? Surely I must be completely confused.
So I reluctantly took the number that CitiBank gave me for "The Vendor", which was something like "Sears Home Health Care" or something and called them. When they guy answered the phone, I immediately demanded to speak to a supervisor and gave no other information. After he reluctantly put me through to a super, the super immediatley came on and agreed to remove the charge and "cancel" the "Health Plan".
Wow - that's interesting - because I never even told him (or anyone) why I was calling, but he knew/assumed this was the case! Are all their calls like this??
I was so blown away by this, I did a little research on the web. It turns out, Sears, and "Sears Home Health" - or whatever, had already settled a class-action lawsuit with the state of California for this type of deal, and had one in the works with Florida. On looking at a few sites on Business scams, on the popup "short-list" of buisinesses they list, both "Sears" and "Sears [whaatever] Health" were always listed!
I refuse to shop at or buy anything from Sears, and enter only to use their bathroom. You probably don't believe my story, or the level of "conspiracy" involved, as I hardly do myself.
My point of this post, is in-fact in response to the original topic: Do you think that a large, public company like Sears risk penalties, suits and their reputation, and would deal in these little petty shenanigans to try to make an extra buck?
Yes, they damn well, would.
I was a regional manager at Sears, and I'm not one bit surprised by this. They don't really care about right and wrong as long as they have positive cashflow. Every day, I had to encourage my employees to "know how to make money." The truth is, people, and by extension, corporations, will take desperate measures in desperate situations.
The management thinks in old ways. They don't really value innovation or best practices. Their computer systems are over 20 years old, and they just don't understand the Internet. Why should they be expected to treat customers as valued partners when they can only see them as a food source?
Gosh, I'm glad I left. There's no way to reach the closed minded except to watch them painfully learn for themselves.
Obviously, games are exempt. I mean unnecessary things like "Browser enhancements", "Desktop enhancements", "Download helpers" (not to be confused with major software companies' download managers) etc. I'm the geek in my family, so when I flew 3000 miles out to visit them I ended up optimizing two peoples' computers in my spare time, amongst other techy tasks. One had a "Desktop Manager" third party program that caused her system to freeze on boot-up every other time, and for some reason she had her task manager disabled. (as Administrator no less) Both had their 512MB of ram bogged down with tons of useless background programs.
The point of my original post was: If you don't need new software to do what you need to do, don't download it. This should work to WoW and other games, as you obviously need to download the software to play it.
Charisma is the measure of someone's ability to lie with a straight face.
I despise malware distributors as much as anyone else, but am I to understand that the author is savvy enough to inspect network packets yet blindly installs some "community software" from sears and/or kmart? What did he think he was getting?
I can understand wanting a recite. It is proof that it came from that store. Target didn't need mine because I bought it with a Credit Card and they could look it up. So they had an electronic record.
People ripe off stores with returns and exchanges all the time. It is fine of you feel that other stores have a better policy and shop there because of that better policy. I just don't feel that policy is to the level of evil.
I will say one thing that I do like about Target and Sears better than Walmart and Best Buy. They don't treat me like a criminal. I am sick of Walmart and other stores demanding to check my recite when I leave their stores. Also the service at Target seems better.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
The word "receipt" is a difficult one to spell. So here's how you can remember. A "receipt" is proof that you "received" something. And you can remember to spell "receive" by the rule "'I' before 'E' except after 'C'".
Also, fruit is "ripe". When you steal from a store, you "rip" them off, as in "grabbing something and tearing it".
Other than that, your English is excellent. By your transliterations, I would guess that you are a native speaker, or at least were educated in an English-speaking school. But usually only relatively young students make the types of spelling mistakes you have; and your user ID would indicate you are not that young. You could be Scottish, I suppose.
We'll believe the side with the most evid^h^h^h^hanecdotes! :)
hawk
Er, I don't think a demonstration of the principles of logic counts as flamebait.
While Sears is spying on you, it's also exposing your purchase records to anyone with your contact info. What penalty will Sears pay for violating its own privacy policy? Will it be on lay-away?
--
make install -not war
I worked at the Belo Horizonte store for Sears in the holiday season of 1987 [they have gone out of biz here in Brasil in 1990 or so -- hope it wasn't my fault :-)].
I worked at the credit granting section as a temp assistant, and our manager was great, but the "corporate policy" in general sucked and treated employees as potential thieves all the time (security checks when you are leaving the store, security crew constantly looking more for employee wrongdoing than shoplifters, etc). I was invited to stay employed, but I was just entering college, and I didn't need that kind of shit at the time. My aunt, who worked at their credit section since the mid-1970's [she has gotten me the gig], was laid off when Sears faded away a couple of years later.
That is to say, sometimes your manager cannot overtune shitty corp policies.
It's better to be the foot on the boot than the face on the pavement. ~~ tkx Kadin2048