Piwik.org compromised, offered Trojanized version of analytics software
Posted on 27.11.2012
The official website of popular free web server analytics system Piwik has been compromised and made to serve a Trojanized version of the software that opens a backdoor on the systems on which is installed.

According to a blog post published today by the Piwik team, the Piwik.org webserver got compromised on November 26, and the modified file was available for download for a little over eight hours.

"The website Piwik.org is running WordPress and got compromised because of a security issue in a WordPress plugin," they explained, adding that no sensitive data has been leaked. "Piwik is a self-hosted, open source software. Piwik.org does not track any web analytics data from any Piwik user. No personal or sensitive data has been leaked since we do not track any."

They warned that the only users affected by the compromise are those who installed or updated to Piwik 1.9.2 on November 26 from 15:43 UTC to 23:59 UTC, and advised them to check the piwik/core/Loader.php file for the tell tale code at the end of it.

They also included step-by-step instructions on how to clean their systems of the affected version and install a clean one.






Spotlight

eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Thu, Dec 18th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //