Piwik Security – Securely Analyzing Web Applications

Nowadays, hardly anyone operates professional web applications without measuring how users actually use their own application. For this purpose, commercial web analytics tools from providers such as Google, Etracker or Econda are often used. The free offering Google Analytics is by far the market leader. Since with this tool one essentially pays with the data of their users and enters into a dependency on Google, many website operators search for alternatives to Google Analytics. As one of the strongest competitors to Google Analytics, the open-source web analytics tool Piwik has enjoyed increasing popularity in recent years. What speaks in favor of using Piwik and how can you prevent Piwik from offering attack potential to hackers? This article and the associated security checklist (pdf) are intended to help you use Piwik securely.

Three good reasons to use Piwik

The first advantage compared to the other major competitors of Google Analytics is the price of the software: it is offered for free. The development team behind Piwik pursues the model of many other open-source projects with Piwik Pro. The basic package for own operation is offered and developed free of charge. The developers earn money with a paid Pro version and a hosting offer. For most use cases, the free basic version is completely sufficient. The Pro version is aimed, for example, at companies that want to analyze the use of their SharePoint intranet. The second major advantage of Piwik over most competitors is that no data is transferred to third parties when hosted on your own. Therefore, there is also a lower risk of violating data protection guidelines. The Independent State Center for Data Protection Schleswig-Holstein (ULD) therefore gives a positive assessment of Piwik. The third reason for using Piwik is finally to be independent of third parties in terms of IT security. If web analytics software is operated externally, one would automatically be affected by an attack on the external service provider, e.g. by malicious code being injected into their software.

Risks when using Piwik

What dangers should be considered when using Piwik from an IT security perspective? First, one must consider the goals to be protected that lie in the "hazard area" of Piwik.

• The server infrastructure on which Piwik is installed.
• The websites in which Piwik is embedded.
• The data collected with Piwik.

This list naturally applies beyond the use of Piwik to any other self-operated web analytics service. One can easily imagine the dangers a successful attack could have: the risks range from delivering malicious code via the website to accessing confidential data stored on the server on which Piwik is installed, or accessible through it.

Specifically, there has already been a successful attack on the Piwik download server in the past. In this case, webmasters who had downloaded Piwik or installed an update during the affected period executed a version of Piwik extended with malicious code on their server. The attack was quickly resolved at the time and several countermeasures were taken by the Piwik team. Nevertheless, the topic of security when installing and updating Piwik is still current, as for example not all download paths function purely via https.

Another neuralgic point of Piwik is the admin backend. Through this, one can not only view the collected analysis data but also upload self-written plug-ins. This is naturally also a welcome feature for an attacker who wants to place malicious code on the websites analyzed by Piwik. Since there is currently no protection against brute-force attacks (systematic guessing of a password) for the admin area from Piwik's side, this must be secured separately.

Many of the described risks naturally do not only exist for Piwik, but generally for any external service, regardless of whether it runs on own servers or is provided by cloud providers. The gratifying thing, however, is that with a little effort, the Piwik web analysis can be secured to a satisfactory extent.

Securing and hardening Piwik in 9 steps

1. Verify Piwik downloads

As described above , there has already been an incident with Piwik in the past where installation files infected with malicious code were provided on the official website. You should therefore not only ensure that you obtain Piwik via https during the initial installation and for updates, but also verify the downloaded files. For this, you need an installation of GnuPG and must execute the following steps in your terminal:

1. Download the public PGP key of the Piwik chief developer Matthieu Aubry.

gpg --keyserver keys.gnupg.net --recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

2. Check the authenticity of the key.

gpg --fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

pub   4096R/5590A237 2013-07-24
  Schl.-Fingerabdruck = 814E 346F A01A 20DB B04B  6807 B5DB D592 5590 A237
uid       [  unbek.] Matthieu Aubry 
uid       [  unbek.] Matthieu Aubry 
uid       [  unbek.] Matthieu Aubry 
sub   4096R/43F0D330 2013-07-24

3. Download the signature file matching the download via https into the same directory and verify the signature. In our example, the installation file is piwik.tar.gz and the signature for it is piwik.tar.gz.asc.

gpg --verify piwik.tar.gz{.asc*,}

gpg: Signature from Thu  4 Feb 07:10:29 2016 CET using RSA key ID 5590A237
gpg: Good signature from "Matthieu Aubry " [unknown]
gpg:                     alias "Matthieu Aubry " [unknown]
gpg:                     alias "Matthieu Aubry " [unknown]

Depending on the case, the output may still contain a warning that the key does not contain a trustworthy signature if you have not yet marked the key as trustworthy.

2. Keep Piwik up to date

Updates often contain patches for discovered security gaps. Therefore, it is important to always keep Piwik up to date. Piwik informs in the admin area via an info box as soon as an update is available. In addition, one can also subscribe to the changelog or the mailing list to be notified about updates. The update can then be installed via two different ways. As a more secure way, we recommend not the one-click update but the manual update from https://builds.piwik.org/piwik.tar.gz or, if Piwik runs on a Debian system, an update via the package manager apt-get.

3. Separate Piwik from other services

So that a security gap in Piwik has no influence on other systems, Piwik should run as separately as possible from other services. Ideally, this would be a separate physical or virtual machine. If this is not possible, at least take the following two precautions:

• Set up a separate virtual host for Piwik with its own web directory (DocumentRoot).
• Create a separate user and separate database for Piwik in MySQL.

4. Secure the admin area

To track website visitors, only the files piwik.js, piwik.php and the opt-out function of the index.php must be made publicly accessible. All other files should be blocked for access from the internet in the configuration of the web server (for example through IP-based access rules or Basic Authentication). Additional protection is achieved if you furthermore completely block access from the outside to the files that are neither directly used by website visitors nor by the admin area. An example configuration for an Apache2 server can be found below . Further solutions exist for nginx servers and Apache .htaccess files (the latter is only recommended if you have no access to the Apache configuration file, for example when installing Piwik in the webspace of a web hoster).

5. Set up Piwik users with read-only rights

The admin user should only be used to configure and update Piwik as well as to set up user accounts. Everyday access to the web statistics should be via a user account without administrative rights. To create new users, one must first go to the administration area in the admin account (via the gear in the upper right corner of the page). In the "Users" sub-area, new users without administrator rights can now be added.

6. Use strong passwords

As with other services, we recommend the use of secure, unique passwords, which can be created and managed, for example, with the help of password management programs such as Keepass.

7. Encrypt data traffic

For the security of website users and the admin backend, Piwik including the transmitted cookies should only be provided via https. In addition, it must be ensured that authentication cookies may not be read by JavaScripts (secure flag and httpOnly in the Set-Cookie header). To achieve this, the web server must first only be accessible via https. Next, the following entry must be added to the [General] section in the config/config.ini.php file of the Piwik directory:

[General]
force_ssl = 1

8. Use Piwik together with security headers

To increase the security of web applications, it is good practice to use HTTP security headers. When using the Content-Security-Policy header (CSP header), one should not use the standard tracking code. Instead of embedding the code provided in the Piwik backend inline into the page, the code must be stored in a JavaScript file on the server. If the code were embedded inline into the page, the CSP header would generally have to allow inline embedded JavaScript. This could, however, also allow JavaScript malicious code injected elsewhere into the website to be executed. Instead, "unsafe-inline" should be forbidden via the CSP header, thereby preventing cross-site scripting attacks (XSS). The tracking code stored in a JavaScript file (piwik_loader.js in the example) must then be embedded into the page together with the tracking pixel (in case the website visitor has deactivated JavaScript) as follows:

<script src="/piwik_loader.js"></script>>
<noscript><img src="https://piwik.example.com/piwik.php?idsite=1" alt="" /></noscript>

In the CSP header, the policy must then be set as follows (if Piwik runs at https://piwik.example.com in the example):

Content-Security-Policy: default-src 'self'; script-src 'self' https://piwik.example.com; object-src 'none'; img-src 'self' https://piwik.example.com; 

If the X-Frame-Options header is used on the Piwik server, the following settings are to be observed. In our Apache2 example configuration , we show how security headers can be set for Apache2 web servers. To check which headers are sent by the server when calling a website, you can, for example, use the Firefox developer tools. In the "Network" tab, you see the headers and their values sent in the HTTP response header. The X-Frame-Options header prevents, just like the "frame-ancestors" rule of the Content-Security-Policy, so-called clickjacking by embedding the own page in other websites as an iframe. By default, the Piwik opt-out is embedded in the own page via iframe. If Piwik and the analyzed website run on the same host, the header must therefore be set to X-Frame-Options: sameorigin. If Piwik, for example, runs on piwik.example.com and is embedded in the website example.com, the header must read X-Frame-Options: allow-from https://example.com. The most restrictive possibility is finally X-Frame-Options: deny. It can be used if the opt-out is realized within the own web application instead of using an iframe, e.g. by setting an opt-out cookie yourself and controlling the embedding of Piwik on the basis of this. Such a Piwik opt-out without iframe can be found, for example, in the aramido privacy policy .

9. Use Piwik SecurityInfo plug-in

To check whether the PHP settings of the web server are secure, the plug-in SecurityInfo can finally be helpful, which carries out various checks and presents the results and improvement recommendations clearly in the admin area.

Example server configuration for Apache2

In the following, we show a pattern for the configuration of an Apache2 web server (version ≥ 2.4) for an optimal securing of Piwik.

# The following instructions should ideally take place within a VirtualHosts block

#The rules below replace the Apache configuration delivered with the Piwik installation, which is therefore commented out.
#Include /etc/piwik/apache.conf

# Forbid access to all files, to subsequently release individual ones 
<FilesMatch ".*">
  Require all denied
</FilesMatch>

<FilesMatch "^(index\.php|)$">
  AuthType Basic
  AuthName "Piwik Admin"
  AuthUserFile /etc/apache2/passwd
  <RequireAny>
  #Access to the admin area via Basic Authentication. Alternatively, certain IPs could be released via "Require ip"
  Require valid-user
  # The opt-out action is released for all website visitors
  Require expr %{QUERY_STRING} == "module=CoreAdminHome&action=optOut"
  </RequireAny>
</FilesMatch>

#Other files that website visitors must be able to access
<FilesMatch "^piwik\.(js|php)|robots\.txt">
  Require all granted
</FilesMatch>

#Release files for the admin area
<LocationMatch "^/(plugins|misc/user|libs)/.*$">
  AuthType Basic
  AuthName "Piwik Admin"
  AuthUserFile /etc/apache2/passwd
  Require valid-user
</LocationMatch>

#Forbid the uploading of files (e.g. custom Piwik plug-ins)
<IfModule mod_php5.c>
  php_admin_flag file_uploads 0
</IfModule>

#HTTP security headers
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
  Header always set X-Content-Type-Options "nosniff"		
  Header always set X-Frame-Options "deny"
  Header always set X-XSS-Protection "1; mode=block"
  Header always set X-Permitted-Cross-Domain-Policies "master-only"
</IfModule>

In the context of the Apache configuration of Piwik, it should also be noted that the use of the Apache module mod_security apparently causes difficulties together with Piwik.

Of course, we cannot go into all possible server configurations and environments at this point. Feel free to contact us if you need support in setting up and securing your web analytics. We look forward to hearing from you .

PDF download of the checklist for securing Piwik