Shopped at Sears?

If you have shopped at Sears and signed up for its "community" online, you might want to get hire someone to clear away the spyware. Like, now.

Security guru Bruce Schneier reports on Sears and its very disturbing spyware.
Is Sears Engaging in Criminal Hacking Behavior?
Join "My SHC Community" on Sears.com, and the company will install some pretty impressive spyware on your computer:

Sears.com is distributing spyware that tracks all your Internet usage - including banking logins, email, and all other forms of Internet usage - all in the name of "community participation." Every website visitor that joins the Sears community installs software that acts as a proxy to every web transaction made on the compromised computer. In other words, if you have installed Sears software ("the proxy") on your system, all data transmitted to and from your system will be intercepted. This extreme level of user tracking is done with little and inconspicuous notice about the true nature of the software. In fact, while registering to join the "community," very little mention is made of software or tracking. Furthermore, after the software is installed, there is no indication on the desktop that the proxy exists on the system, so users are tracked silently.
Here is a summary of what the software does and how it is used. The proxy:

Monitors and transmits a copy of all Internet traffic going from and coming to the compromised system.

Monitors secure sessions (websites beginning with ‘https'), which may include shopping or banking sites.
Records and transmits "the pace and style with which you enter information online..."
Parses the header section of personal emails.
May combine any data intercepted with additional information like "select credit bureau information" and other sources like "consumer preference reporting companies or credit reporting agencies".
If a kid with a scary hacker name did this sort of thing, he'd be arrested. But this is Sears, so who knows what will happen to them. But what should happen is that the anti-spyware companies should treat this as the malware it is, and not ignore it because it's done by a Fortune 500 company.

Here's some more:
CA Security Advisor Research Blog
Managemyhome.com: Another privacy issue for Sears

"Hey Dad, did you guys by any chance buy a new sewing machine from Sears on September 30th?"

"We did. How did you know that?"

"I just found it listed on a Sears web site. It looks like they have another privacy problem."

We were informed about managemyhome.com by Heather, who left the following comment on Benjamin Googins' last blog entry:

OMG. It gets worse! check out a sears site managemyhome.com. Once you register, you can look up major purchases for ANY address. All you need to do is enter a name address and phone number and if the person attached to that info has made a major purchase at sears you get that info!! They have no real controls in place -- you have to enter an onscreen code and they say that keeps your info safe, but that does not stop someone from entering other people's contact info to see their product purchases. This brings casing someone's house to a whole new level.