Piwik.org compromised, offered Trojanized version of analytics software
Posted on 27.11.2012
The official website of popular free web server analytics system Piwik has been compromised and made to serve a Trojanized version of the software that opens a backdoor on the systems on which is installed.

According to a blog post published today by the Piwik team, the Piwik.org webserver got compromised on November 26, and the modified file was available for download for a little over eight hours.

"The website Piwik.org is running WordPress and got compromised because of a security issue in a WordPress plugin," they explained, adding that no sensitive data has been leaked. "Piwik is a self-hosted, open source software. Piwik.org does not track any web analytics data from any Piwik user. No personal or sensitive data has been leaked since we do not track any."

They warned that the only users affected by the compromise are those who installed or updated to Piwik 1.9.2 on November 26 from 15:43 UTC to 23:59 UTC, and advised them to check the piwik/core/Loader.php file for the tell tale code at the end of it.

They also included step-by-step instructions on how to clean their systems of the affected version and install a clean one.






Spotlight

Patching: The least understood line of defense

Posted on 29 August 2014.  |  How many end users, indeed how many IT pros, truly get patching? Sure, many of us see Windows install updates when we shut down our PC and think all is well. Itís not.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Tue, Sep 2nd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //