Researcher Accuses Sears of Spreading Spyware
114077
A Harvard researcher is criticizing Sears of failing to meet FTC guidelines with marketing software it installs on users' PCs.
206560
A company finds a sneaky new way to silence security researchers: Claim that defeating its products infringes on patents. Commentary by Jennifer Granick.
370286
Google confirmed the findings of a security researcher who warned that a security hole in the Google Toolbar could be exploited to download malicious files or launch phishing attacks.
441496
The man at the center of the nation's first spyware case &#151; a businessman notorious for his junk Internet mailings &#151; says federal regulators were politically motivated in targeting him for enforcement of new bills outlawing intrusive software.
115593
FTC Filing Targets Malicious Spyware  Spyware has come under target of the Federal Trade Commission with a new complaint filed in federal court which is requesting that two Internet based advertising and software firms be closed. The FTC filing was made last week with a press conference to be scheduled for ...
626677
A prominent Internet safety organization and leading computer-maker Dell Inc. (DELL) launched a campaign Friday to help consumers fend off "spyware," software that can cause sluggish computer performance or popup ads and secretly monitor the activities of Internet users...
37133
When technicians examined the PCs of 329 respondents, they found 80 percent loaded with dozens of spyware programs that track the user&#39;s browsing habits.
30117
During the past few months, the Federal Trade Commission has filed deceptive- advertising cases against two distributors of what is called adware or spyware. The insidious form of software subjects consumers and their computers to unwanted advertising and surveillance.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
722409
A visiting scholar whose computer has been linked to a hacker attack at the University of California, Berkeley, released a statement late Friday saying she believed her equipment
190742
Federal authorities have asked a federal judge to shut down an operation that they said installed intrusive "spyware" on people's computers and then sold anti-spyware software to those same victims, a top consumer protection official said Tuesday.
672869
By JAMES COATES, CHICAGO TRIBUNE  Q. I am at my wits' end with my two sons' IBM laptop computers that are riddled with spyware and viruses to the extent that the computers are almost unusable.
412540
Security researches are criticizing retailer Sears for not adequately describing its efforts to track the behaviors of those who provide the company with their contact information.
428206
Sears Holdings is facing a class-action lawsuit after&#160;making the purchase history of its customers public&#160;on its Managemyhome.com Web site.The lawsuit seeks damages as well as an accounting by Sears to determine whether the Web site was misused by criminals. It was filed on Friday by New Jersey resident Christine Desantis, who is represented by KamberEdelson, a technology law firm. KamberEdelson is best known for its recent settlement with social networking site Facebook over its sending of unwanted text messages to recycled cell-phone numbers.&quot;It&#39;s a pretty simple case,&quot; said Jay Edelson, a partner with the Chicago-based law firm. &quot;Sears decided to put private information of its customers up on the Web site and make it publicly available. They did it without telling their customers that it was going to happen ... and they really did it for their own financial reasons.&quot;Manage My Home is a community portal where Sears shoppers can download product manuals, find product tips and get home renovation ideas. The Web site had a feature called &quot;Find your products&quot; that ostensibly was designed to help users look up past purchases.Last Thursday, researchers at security vendor CA pointed out that the feature could be used to look up the purchase history of any Sears customer, an apparent violation of the company&#39;s privacy policy.Manage My Home could easily have been misused by criminals, Edelson said. For example, a robber could gain access to a victim&#39;s home by posing as a Sears repair person, using the information available on the site. That could be incredibly scary, he said. &quot;They have a duty to keep that information away from the public.&quot;Sears disabled the &quot;Find your products&quot; feature&#160;on Friday, saying it would re-introduce the feature once the company figures out a way of ensuring that the information cannot be viewed by unauthorized third parties.However, the retailer was informed of the problem weeks before it took the feature off-line, Edelson said.In late December, CA researchers also criticized Sears for&#160;downloading invasive comScore Web tracking software&#160;onto the desktops of some members of its MySHCcommunity.com Web site without adequate disclosure.KamberEdelson is also investigating that matter, Edelson said.&#160;
267586
Security researchers have warned of a vulnerability in most web browsers that could let scammers launch phishing attacks from pop-up windows on trusted websites.
74211
For millions of PC users, the privacy-snatching programs known as spyware have been nothing but a headache as they swipe personal information, slow systems to a crawl and crash computers.
185129
Hackers get what they want Sears Roebuck and Co. is taking more flack from privacy advocates who say the retailer's websites don't adequately protect customer privacy.â¦