Piwik.org compromised, offered Trojanized version of analytics software
Posted on 27.11.2012
The official website of popular free web server analytics system Piwik has been compromised and made to serve a Trojanized version of the software that opens a backdoor on the systems on which is installed.

According to a blog post published today by the Piwik team, the Piwik.org webserver got compromised on November 26, and the modified file was available for download for a little over eight hours.

"The website Piwik.org is running WordPress and got compromised because of a security issue in a WordPress plugin," they explained, adding that no sensitive data has been leaked. "Piwik is a self-hosted, open source software. Piwik.org does not track any web analytics data from any Piwik user. No personal or sensitive data has been leaked since we do not track any."

They warned that the only users affected by the compromise are those who installed or updated to Piwik 1.9.2 on November 26 from 15:43 UTC to 23:59 UTC, and advised them to check the piwik/core/Loader.php file for the tell tale code at the end of it.

They also included step-by-step instructions on how to clean their systems of the affected version and install a clean one.






Spotlight

New Zeus variant targets users of 150 banks

Posted on 19 December 2014.  |  A new variant of the infamous Zeus banking and information-stealing Trojan has been created to target the users of over 150 different banks and 20 payment systems in 15 countries, including the UK, the US, Russia, Spain and Japan.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Mon, Dec 22nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //