Last week, security researchers revealed that Sears was installing spyware on the PCs of consumers who signed up for Sears’ “community” program, MySHCCommunity.com. Then Thursday, a Computer Associates analyst detailed that another Sears site, ManageMyHome.com, revealed the shopping history of customers using just a name or address.
Sears disabled the feature by Friday, indicating that incompetence rather than malfeasance was responsible. CA analyst Stefan Berteau searched the site using his parents’ names, address and phone number and got back “a list of their major Sears purchases running back almost two decades to when they first moved in to that house.”
That security glitch, which represented a “real and immediate threat” to consumers’ privacy, was quietly fixed the next day, and Berteau said he was “happy to see them reacting so promptly” but hoped they would take “similarly responsible actions” regarding MySHCCommunity.
CA analyst Benjamin Googins last month revealed that Sears’ community program involves the distribution of spyware onto consumers’ computers. “Sears.com is distributing spyware that tracks all your Internet usage — including banking logins, email, and all other forms of Internet usage — all in the name of ‘community participation,’ ” he wrote.
“If you have installed Sears software on your system, all data transmitted to and from your system will be intercepted. This extreme level of user tracking is done with little and inconspicuous notice about the true nature of the software.” The registration process makes “very little” mention of the tracking software, and once installed, the software’s presence is not apparent to the user, he added.
Sears Vice President Rob Harles responded twice to Googins’ revelations, defending the program. Harles said that “the overwhelming majority of members are not tracked, nor invited to be tracked;” Sears gives prominent notice to users it invites to be tracked; the process…