Piwik.org compromised, offered Trojanized version of analytics software

The official website of popular free web server analytics system Piwik has been compromised and made to serve a Trojanized version of the software that opens a backdoor on the systems on which is installed.

According to a blog post published today by the Piwik team, the Piwik.org webserver got compromised on November 26, and the modified file was available for download for a little over eight hours.

“The website Piwik.org is running WordPress and got compromised because of a security issue in a WordPress plugin,” they explained, adding that no sensitive data has been leaked. “Piwik is a self-hosted, open source software. Piwik.org does not track any web analytics data from any Piwik user. No personal or sensitive data has been leaked since we do not track any.”

They warned that the only users affected by the compromise are those who installed or updated to Piwik 1.9.2 on November 26 from 15:43 UTC to 23:59 UTC, and advised them to check the piwik/core/Loader.php file for the tell tale code at the end of it.

They also included step-by-step instructions on how to clean their systems of the affected version and install a clean one.