Alert: Backdoor placed in Piwik

Re:Alert: Backdoor placed in Piwik by jpdoctor on Tuesday November 27, 2012 @09:56AM (#4837356)

Would love to know how they detected it.

[ Parent | on HN ]

Re:Alert: Backdoor placed in Piwik by zalew on Tuesday November 27, 2012 @09:59AM (#4837367)

they didn't. some guy reported it on the forum http://forum.piwik.org/read.php?2,97666

[ Parent | on HN ]

Re:Alert: Backdoor placed in Piwik by jpdoctor on Tuesday November 27, 2012 @11:52AM (#4837641)

Good find. Of course, it just changes my question to: How did he find it?

[ Parent | on HN ]

Re:Alert: Backdoor placed in Piwik by klibertp on Tuesday November 27, 2012 @02:27PM (#4838367)

Either he noticed effects of running the exploit (lic.log file?) or just downloaded the zip to read the code (I do this when some project's VCS doesn't have 'browse source' component or it's web component has no decent syntax highlighting), noticed base64 encoded chunks and got curious. I'd get curious for sure.

All this is really simple and not the real question, which instead is: where were checksums and why not in a safe place?

[ Parent | on HN ]