Re:Alert: Backdoor placed in Piwik
by driverdan on Tuesday November 27, 2012 @11:06AM
(#4837519)
Piwik should release a new version so all users get a message about updating in their dashboard. That way someone who doesn't see this alert would be more likely to fix it.
[ Parent
| on HN ]
Re:Alert: Backdoor placed in Piwik
by micheljansen on Tuesday November 27, 2012 @11:46AM
(#4837623)
Agreed, but that alone wouldn't be enough.
If you read into what the hack does on the forums [1], it actually downloads and installs a backdoor that can execute arbitrary commands on your server. Unless a new version explicitly looks for and removes those files, updating is not enough.