Maltego Blog

3.1 Splash screen

2012-01-12T13:10:00.001+02:00

When we release splash screens you know it's close. Here's what we think 3.1 startup screen will look like:

Maltego CaseFile and Maltego 3.1 release date

2012-01-11T12:48:00.000+02:00

Happy 2012, Christmas, hope this year..blah blah.

With that out the way - we are working hard to release Maltego CaseFile v1.0 and Maltego 3.1 at the end of January.

Maltego 3.1 will have the same features as Casefile but will include the use of transforms. We are still very much committed to make CaseFile FREE for non-commercial users. Both 3.1 and CaseFile will have fully supported Windows, OSX and Linux versions. A community version of Maltego 3.1 will follow in the weeks to come - and we'll ask Muts and Chris to bundle it with their new BackTrack release.

CaseFile and 3.1 should work seamlessly together. Clients with dedicated Maltego servers should upgrade to the new CTAS (which will be released at the same time).

There! Our first blog post for 2012!
RT

Racing against time the developers...CaseFile (OSX)

2011-11-29T15:19:00.001+02:00

Racing against time the developers knew that the entire IC was watching, constantly refreshing the Paterva blog and Twitter feed for news of the CaseFile (beta) OSX release. With blood running from their raw fingertips they put the final touches on the DMG package and SCP-ed it across the intertubes to the Paterva website. It took a while to get there but when the upload finally finished there was a sense of achievement and accomplishment around the office. The devs looked at each other, their eyes still wide from the adrenaline rush of putting out yet another release.

Tomorrow they will back at their desks again, changing the world of intelligence gathering one line of code at a time.

You can play/look at/use their work by simply clicking on the link below:
[Maltego CaseFile (beta) build 1950 DMG]

More details about Maltego CaseFile and Maltego 3.1

2011-11-28T21:26:00.001+02:00

So far we've had very positive feedback on [Maltego CaseFile]. We've had the same questions from various people and I've decided to put the answers here on the blog:

Q: Will CaseFile be available for OSX and Linux?
A: Yes. We will have an OSX version very soon - hopefully within this week. Like the Win version, it's still beta. If there is enough interest in a Linux version (beta) we'll put one together.

Q: When is the official release of CaseFile?
A: Hopefully early in 2012.

Q: Will Maltego 3.1 have the same features as CaseFile?
A: Yes, and if you have a license you get a free upgrade from 3.0.4 to 3.1. Out of the box Maltego 3.1 will not come with all the CaseFile entities, but you will be able to export them from CF to 3.1 as you need them. You will be able to open CF graphs in 3.1 and use transforms on CF entities as always.

Q: What do you mean CaseFile will be"almost free"?
A: We will sell CaseFile for around $200 per copy - perhaps in batches of 5. If you are a corporation or an organization that use CaseFile for commercial reasons you should buy licenses. If not - you are welcome to use the community edition free of charge. The only difference will be the background. We believe people will do the right thing and support us.

Q: Will there be a Maltego 3.1 community edition?
A: Yes - we normally release community editions a few weeks after the commercial edition.

We are also working on Maltego 4.0 - people that saw the 44Con talk in London would know what it's all about. 4.0 will change the way you think about information forever...

Maltego CaseFile Beta released

2011-11-23T15:46:00.004+02:00

We are proudly releasing Maltego CaseFile Beta today. Yup - after some time we feel CaseFile is ready to see the light. And best of all - it's free - no registration, no silly forms or CAPTCHAs - just download and go.

CaseFile is aimed at analysts that do not necessarily use open sources of intelligence (or even the Internet for that matter). Think of it as Maltego without transforms but with tons of new features. Adding/attaching photos, documents and annotations to nodes, graph merging, better integration with browsers, passwords on graphs, and tons of new useful entities - and this is just a few of the goodies we've added into CaseFile.

To get a better idea of what CaseFile is and where it fits in with Maltego (as well as our future plans with it) we've made a 10 minute demo video on it - here you can see features explained and demonstrated in real time:

The download links for CaseFile beta:
[ 32 bit (with JRE) ]
[ 64 bit (with JRE) ]

Let us know what you think of CaseFile Beta- we're very curious!
Enjoy,
RT

New Maltego video (SQL DB integration), new web front page

2011-11-14T15:35:00.001+02:00

We've made another video - yes I know we said we'll stop at five, but we've realized that we never ever showed anyone our [SQLTAS] (blame it on the lack of salesman genes). So - just before our year end function Andrew and I whipped up another video. We shot it here in the office and it deals with hooking Maltego onto SQL databases. It's added to the [Youtube playlist] as video 6.

We've also changed the front page of [our website] - it now shows some stills from the videos and I think it looks rather nice. We are thinking of putting all of the videos (in yummy 720p) on a DVD that we'll give away for free (minus cost). We noticed that many of our clients don't have Internet access at work....;) If you are interested in this [let us know].

We're doing 91% fine thanks - Sectools & Blackhat

2011-11-08T09:11:00.001+02:00

We don't get out much. In our line of business we rarely get to speak to people face to face (expect when we train). To determine if your business is doing OK you look at comments from people - on Twitter, forums, in mailing lists or direct email. You look at number of downloads, number of licenses sold. You look at the number of pageviews on your website and this blog. Every now and then a number comes along that's just a little bit more important.

Sectools

The [SecTools Top 125 tools] is like the Oscars for security tools. Right - everyone knows that it's impossible and unfair to compare the [traceroute command] (21) to [Google] (26) or [VMware] (43) to [Python] (23), but this list is a start. It's an indication. The the survey ran in 2000, 2003, 2006 and now in 2011 (unless I missed one?).

So how did we do?

In a nutshell - pretty OK. Overall [Maltego] made number 34 (of 125). If this was an exam we'd have 72.8%. We were voted nr. 1 in the [Forensics] category - and while this is great I am sure the hard core forensics guys have their own list that they keep somewhere. What's really awesome is that we're nr. 4 of all [new tools] - and there are 49 new tools in the list (91.8%). A new tool means it was released since the [last run] - which was in 2006. Being nr. 4 in security tools released in the last five years - that's something we're really proud of. Especially when you think that Maltego is not a dedicated security tool! (I guess neither is Python, Google, VMware or traceroute...;)

Fyodor - thanks for putting this together. I am sure it's a ton of work.

BlackHat Vegas training 2011 - feedback.

Another hard, real number is the BlackHat (Vegas) training feedback. We got ours yesterday. Keep in mind that we did two classes and on day one of the first session the hotel internet connection was dead. Someone wrote "Paterva was great. Not having Net for the first day was annoying". Some of our session two students wrote "Roelof and Andrew were superb! It was obvious to everyone in the class how well prepared they were." and "Very well done; very personal and good hands-on pracs.".

Our average score for the two sessions combined?
91.22% YEAAH!

When we have machines in Maltego...

2011-11-02T23:19:00.000+02:00

...I fear we'll end here:
http://xkcd.com/416/

RT

Extending Maltego - video tutorial nr 5.

2011-11-01T18:36:00.000+02:00

After being almost hit by Highveld lightning we've decided to call it quits on making more Maltego videos for now. But we did produce a final one for 2011 - it's all about extending Maltego with your own custom entities and transforms. Having the patience of a saint Andrew will explain to you exactly how it's done - in 15 minutes.

The link to the video is [here] or you can click below:

Maltego Casefile - icons finally here!

2011-10-29T19:23:00.005+02:00

Our icons arrived this week. This is gooood news - it means we can release the beta of CaseFile very soon - probably this coming week.

Here is a screenshot of what's to expect - we haven't properly named the entities yet but you'll get the idea. There are 61 new icons - most of them related to Law Enforcement.

Watch this space!
RT

Maltego and social networks [video tutorial nr.4]

2011-10-24T11:56:00.003+02:00

We've made another tutorial video - this time showing how Maltego can be used to link infrastructure and people. For social network resolving we're using [SocialNet from PacketNinjas].

Personally I am way pleased with the way the intro and extro (is that even a word?) came out. It was taken in a pretty large open room, so there's a bit of echo, but if you use headphones it should be fine.

Video is [here], or click below:

We've made these videos to show you how we use Maltego - hopefully it would be useful to you. Let us know!

Enjoy,
RT

Using Socialnet + Maltego to visualize social sphere of influence.

2011-10-21T14:37:00.004+02:00

Used Socialnet to visual my Facebook friends (plus second order) in Maltego. Interesting that you can group people purely on their location in the graph - in organic view. Click on the picture above to enlarge, and you'll see what I mean!

'later,
RT

Maltego Video Tutorials

2011-10-17T17:52:00.012+02:00

Hi guys,

We have seen a great number of Maltego videos coming out in the last few months and we have been really impressed with some of things you guys are doing. As such we have decided to create some of our own to help people better use and understand the tool!

We originally thought we could do this via the userguide section on our website - www.paterva.com/web5/documentation/userguide.php. However, we have still seen a number of users struggling with the basics (in videos, writeups as well as email) and we really want to get everyone past these stumbling blocks and onto the true power of Maltego.

We have had a whole week of making videos (which is a pain since one of us has to be in a video and the other one has to edit them all!). Thus we present to you under a shower of rainbows and unicorns our 3 latest Maltego videos. Each one of the videos deals with teaching some aspects of the tool and also gives an interesting sample case.

Sit back and enjoy the videos

Mapping Google websites to find the odd-ones-out:
http://www.youtube.com/watch?v=3zlbUck_BLk

In this video we show how to start Maltego, create a new graph, graph navigation, selecting nodes and running transforms. We also show how to use different views
Quickly Identifying some of Sony's netblocks:
http://www.youtube.com/watch?v=ibtwjPJ5PGs

In this video we show how to use sets of transforms, basic footprinting techniques, transform settings and using the detail view. We also discuss one of the transforms in more detail.
Finding links between data stored in CSV files (airodump)
http://www.youtube.com/watch?v=xaPoLQwHYI4

In this video we show you how to import data from CSV and XLS files and create graphs directly from it. We've used data mined with Airodump in this tutorial.

With the power of Grayskull
-AM && RT

Importing data into Maltego

2011-10-01T08:37:00.005+02:00

@Viss - you make us sad bears with your question on importing. So I decided to make a quick blog post on how to get data into Maltego.

The right way (import)
The commercial version of Maltego has support for visualizing spreadsheets. You can also use this to simple import a single column of data. Let's say you want to import only names. Then it goes a little like so:

Click on the picture above to see what's actually going on. Importing data this way seems like a lot of effort, but it's really useful. Why? Because it allows you to import multiple columns and make a real graph. Imagine you had phone numbers as well - then you could easily end up with this (skipping the boring bits):

You can "chain" any number of nodes together - in this case we've only used two.

The quick way

You can import entities into Maltego (also in the community edition) by copy and pasting it from text. Usually Maltego does a great job of figuring out what it is that you are pasting - but you can force the entity type by pre-pending it in the actual text. Check this out:

Of course, this does not give you the ability to actually create graphs - it just imports the nodes. But...wait..that's what you wanted right?

Maltego CaseFile - real soon now...

2011-09-30T07:11:00.006+02:00

By now you should know that when we show splash screens here on the blog we are way close to a release. This is true for CaseFile too. We are basically waiting on the icon guys and the fixing of small (mostly cosmetic) bugs - and then we'll release. Watch this space, because the next post will be all about CaseFile.

Crisp out,
RT

A picture is worth a thousand words.

2011-09-22T22:12:00.003+02:00

Think bookmarks, annotations, attachments. Merging graphs. Soon.

Maltego Update Pack!

2011-09-05T16:35:00.010+02:00

Introduction

I know it really has been a while since we last updated anything or made a new blogpost (almost a month!) but things really have been crazy around here! Roelof has been away at 44con and should be making his way to the airport as you read this. It seems to have gone phenomenally well with one of the attendee's referring to him as 44con's "blue eyed boy". Additionally the guys over at Pinkmatter are frantically working on the new releases (3.1, CaseFile and the 4.0 branch!). Those of you lucky enough to attend 44con got to see the sneak peak of 4.0 and our ideas for it. Those of you not lucky enough will have to wait until Roelof decides its time for another video :)

But on with the updates! We have been slowly pushing transforms to the commercial and community users, however today we are unleashing all 50 (yes, 50) transforms! And as we speak I am uploading a document that covers the majority of them. All of them were developed using the TDS ( https://www.paterva.com/web5/TDS/index.php ). Feel free to develop some of your own - it's really easy!

The new transforms deal with things like Images, EXIF, GPS co-ordinates and Aliases, and as such you will need new entities so that you can use these types of information within Maltego. I've split it into two sections (I see we now blog with sections!), the quick way for people who know how to import entities already, and the long way which goes into a bit more detail (read pictures).

The quick way

Download the entity pack (www.paterva.com/UpdatePack/MaltegoUpdatePackEntities.mtz )
Manage Tab -> Import Entities -> locate file above
Next-> Next -> Finish

The long way

Download the entity pack (www.paterva.com/UpdatePack/MaltegoUpdatePackEntities.mtz )- It's a .mtz file, save it somewhere you can get to
Within Maltego click on the "Manage" tab at the top
Click on Import Entities
Select the file from the wizard and click Next
Check the entities checkbox and click Finish

1. Click on the Manage Tab

2. Click on Import Entities

3. Select the file you downloaded earlier and click Next

4. Check the entities checkbox and click Next

5. Click finish and enjoy!

At this stage you should now have new entities in the Palette on the left, as seen below:

Now that we have the entities setup, lets get some new transforms!

Discovering new Transforms

I didn't split this into sections as this is relatively quick and painless

Under the manage tab again, click Discover transforms
Click next through the wizard and enjoy your new transforms!

You should now have all whopping 50 transforms!

Some of my favourites

IPAddress to Wiki Edits - Shows what wikipedia pages specific IP addresses modified
Alias to Facebook Affliation - Use an alias found else where (say myspace) or added yourself to find out if there is a facebook affiliation with the same vanity URL!
To Exif Information - Useful when used in conjunction with twitpic to determine locations, devices and other information about targets
To Location GeoCode - Used to take GPS co-ordinates to a specific address

Documentation

Its definitely worthwhile however to read the documentation describing most of the new transforms, its a big download (24mb!), but definitely worth it!

Get the documentation here: http://www.paterva.com/UpdatePack/Maltego3TDSTransformGuideAM.pdf

Disclaimer

While we have done our utmost to test these transforms, please let us know if any don't work as advertised and we will try and get it fixed as quickly as possible.

"The way I see it, if you're gonna build a time machine into a car, why not do it with some style? "
-AM

And we're back...

2011-08-15T18:08:00.005+02:00

After a bit of a struggle to regain control of this blog (think Google account issues..:|) we're back on track.

We came back some days ago from Las Vegas where we've trained on Maltego. It was great fun - expect for the very first day when our Internet connection went down. Attached is a photo of our training poster. We desperately wanted to take the poster back to South Africa, but we forgot. Hmm..I wonder why. You can also see a short video I made of the prep, training and parties [here].

But Vegas is done and dusted. Next up is [44Con] and then [SANS]. Both in London. We're really looking forward to it. Speaking of forward - here are some tentative schedules for new Maltego releases.

Maltego 3.1 - Releasing soon after 44Con. Think Octoberish. TONS of new features. I'll make a separate post for it when we're closer to the time. Note that this is a major release - it's not 3.0.5. The 3.1 release will be the first step to take us to version 4.0.

Also - in our weeks of silence we've build around 50 new transforms. Yea - 50. They deal with things like images, GPS coordinates, more social networks and aliases. And we'll be showing how these work and be releasing these to the commercial and community server at 44Con...and...Maltego 3.1 will have a couple of new default entities.

Maltego CaseFile - as promised before, we are releasing a Maltego version that is transform free. This will be released at the same time as 3.1, or very close to it. Our German friends are hard at work at creating our entity icons (around 65 in total). This version of Maltego will be specifically useful for Intelligence Analysts that work with internal (or self created) data.

Maltego 4.0. No date set, we are taking it one release at a time. But we're already developing some of the core tech needed for it. If you want to see what cool concepts we'll have in 4.0 come see the talk at 44Con. I'll be demo-ing some of it. No really, it's a game changer.

We'll be keeping the blog updated as we go along - so check in regularly.
'later,
RT

Maltego 304 CE is out!

2011-04-21T11:35:00.005+02:00

Hey ladies,

First off, happy Easter and all that, hope you have a great holiday :)

Onwards to 88mph! Maltego CE has finally been updated to be almost in sync with the commercial version, which means you get most of the tasty treats we put into the paid-for version for free! Think manual linking, link labels, copying to new graphs and all the updates you may have read on the blog.

But wait, if you phone within the next 15 minutes there is more! We also _FINALLY_ have an OSX version for Maltego Community Edition - now all your shiny Mac's can have shiny free Maltego's! (Not for commercial use, restrictions apply, one copy per customer, discount coupons do not apply, subject to in-store activation, cannot be used with free minutes, Void if modified, copied, reproduced, transferred, purchased.)

We have also created a Facebook page where we can have some fun, maybe sneak out beta releases (like we did for this one) and interact a bit more with the community. Please like our page and be our friend (we get lonely too!) - [Maltego Facebook Page].

As per normal the link is over at [http://www.paterva.com/web5/client/download.php]

Live long and prosper,
Andrew

Maltego CE (3.0.4) soon - for BT5 and OSX too!

2011-04-18T16:09:00.005+02:00

How many people have downloaded, installed and registered the community edition of Maltego? Let's take a peek:

+----------+
| count(*) |
+----------+
| 29197 |
+----------+

And that's from July 2010 - which is ... more than 100 activations PER DAY.

We saw this number a couple of days ago for the first time and we were blown away. Based on it we decided to update the Maltego Community Edition and we're in the final stage of testing it. It will update the CE version to the latest commercial edition - that's 3.0.4. It means you get to play with almost all of the commercial features and bug fixes that we've made (that's 4 releases worth of goodness). Expect *massive* speed increase, support for large graphs, manual linking, link labels, tons of bug fixes etc. As as always you can load and save graphs, create and share your own entities and use our [TDS] to code and share your own transforms.

Also just some minutes ago we chained the Social Media and Infrastructure seed to the main CTAS seed - so if you rediscover transforms you get to play with many more transforms. BTW - the new version of Maltego will check periodically for new transforms - so you never have to manually do that again.

This release will also be hooked into Backtrack 5 that's released soon (we hear). Even better - we have a OSX Community Edition as well!

So, just hang in there - lots of goodies en route.
RT

PS: the splash screen for Maltego in Backtrack looks like this:

Maltego 3.0.4 Update 1

2011-04-14T12:20:00.008+02:00

Hey guys,

We noticed there are a few bugs in the last update and our superstar dev team managed to quickly resolve so feel free to pull the latest release.

Changes (since rev1409):

Correctly assign category of new entity spec to entity spec instance. (Fixes exporting of new entities)
Fixed import of exported 3.0.3 entities (entities without exported categories) in 3.0.4.
Fixed auto discovery finding updated transforms after those transforms were run (V2 matching rule was only set once transform was run).
Fixed transforms being removed when only a few transforms were updated during auto discovery.

The biggest fix was just the importing of entities - it looks fantastic now and we are loving the ability to export your entire Maltego config and set it up on another instance.

Get it as always over at http://www.paterva.com/web5/client/download.php#Commercial

Cheers,
Andrew

Maltego 3.0.4 has just gone live...

2011-04-06T15:19:00.004+02:00

Hi there,

We've have just uploaded Maltego 3.0.4! New splashscreen, [CSV, XLS direct import], export entire Maltego configuration, some minor bug fixes and all the usual goodness you come to expect from a new Maltego release. Go [grab] it now!

Enjoy!

CSV,XLS(X) import in Maltego 3.0.4

2011-04-01T10:00:00.012+02:00

We will be releasing Maltego 3.0.4 next week! It looks, feels and smells the same as 3.0.3. In fact, you might ask why we even bothered with a new release. The answer - CSV/XLS/XLSX import. Lots of people asked for it, and here it is!

Our spreadsheet importer is not perfect but I think it's a good start. As per usual we've had lots and lots of features that we could have implemented but didn't due to time constraints. We want to rather release something that is useful -but perhaps not perfect - than not releasing anything at all. If you like it let us know and we'll add features as we go along.

So - enough blah blah - let's see how it works. You start by clicking on the application button and go to the Import section.

You'll see there is a new option called 'Import graph from table'. This will take you to the file selection menu where you can choose the file to import (CSV, XLS, XLSX supported):

Once you've chosen the file to render you need to select colums and map them to entities. This is a simple process - just select the column and pick an entity type from the dropdown:

That's it - you are DONE! Now click 'Finish' and your graph is created:

In the example graph above we only chose two columns to map - so the graph is not exactly exiting (I think this shows email addresses and phone numbers of teachers in Canada - it's just a random CSV file we grabbed from the 'net).

Of course you can chose multiple colums and even map certain columns to an entity's additional fields. This is clearly useful when you have a 'first name' column and a 'last name' column but you want to map both to a single Person Entity. It's totally do-able - just use Control Click. But more about that when the official documentation is around.

If you want to quickly map a table and you don't care that the entity types make sense (you can always create your own entities first - but I am lazy) you can build a graph like this in about six clicks:

Here I looked what the Guild, Genus, Species and Family of some animals looks like when graphed. Uhmm...I mapped Genus to DNS Name and Guild to an AS number...lol...if you only want to see how everything is connected that's OK I guess ;) Click on the graph above to see a higher resolution view of it.

We're still struggling with some minor file format issues, but this should be done in a couple of days. Expect coolness next week some time.

Enjoy!
RT

PS: Also in 3.0.4 is export and import of your *entire* Maltego configuration. Useful if you've set up transform settings, seeds, servers etc. etc. and want your boy/girlfriend's install of Maltego to look and feel *exactly* the same...

New Maltego product and 3.0.4 release dates

2011-03-01T11:48:00.002+02:00

Hi there,

It's been a while. Sorry for that - we're slacking. Actually - we've been busy doing a couple of conferences. In February Chris and Andrew spoke at [IT Defense] in Frankfurt and a week later I spoke at [Hackcon] in Oslo. And we're getting ready to do Maltego [training] and a 3 hour [workshop] at BlackHat Barcelona. So there's that as an excuse. But this post is not only about excuses. No - after an awesome breakfast meeting at [Barn52] we've come to an agreement on the roadmap for Maltego in 2011 and I would like to share some of it with you, the reader..;)

Maltego 3.0.4 should be ready for release at the end of March 2011. The major feature in 3.0.4 is the direct import of spreadsheet files. Yup..eventually we get to do that - input is a spreadsheet and output is beautiful graph. Also think import and export of the entire Maltego configuration and license expiry notification (but those don't really count compared to XLSX and CSV import).

Once that is in place you'll see a split in the product. Think Maltego Lite. Although we all hate the word and we'll NEVER EVER call it that, it kind of describes what we have in mind quite well. Think Maltego without transforms but with lots of new, crisp entities, manual linking, link description, layouts, analysis and spreadsheet import, manual layouts, photo and document adding, annotations & bookmarking, graph merging etc. etc. All at a price that you can easily afford.

Of course, all of the (new) good stuff will go into the flagship 3.0.5 (or perhaps 3.1) as well and the idea is to release the two products at the same time. When can you expect this goodness? "Nou nou" - which in Afrikaans means anything between 10 minutes and 6 months.

RT

PS: If you're in Barcelona come say 'Hi'. We're fairly friendly. We're on 5 days without incident...;)

Maltego 3.0.3 - It's Alive!

2011-01-17T18:13:00.007+02:00

Finally the slog is over, the performance release is here! This has to have been one of the easiest release schedules we have managed, besides for some small scale [flooding of the roads near us] this still counts as office hours.

This release offers a fantastic amount of stability and most importantly speed to Maltego - the devs have done an absolutely marvelous job! +++ to the Pienkies!!

Also - Roelof has edited our mangled together user guide and built a massive document describing all of the transforms. He even managed to slay some pretty hefty Word style dragons to get it here, so don't forget to [check it out] too. The updated Maltego user guide (looking very grown up) can be found there as well.

Finally - [get 3.0.3 now] - faster than you can scream "Lerooooy Jenkins!!"

-AM

Maltego 3.0.3 release date

2011-01-13T11:52:00.002+02:00

Hiya,

We're happy to announce that, if all goes according to plan, we'll be releasing Maltego 3.0.3 this coming Monday. What's new in 3.0.3 you may ask? A lot of bug fixes, and a loads of speed and performance improvements. But if we just say it you won't believe us. So for the first time - here is the raw, unedited changelog (in a small font, because it takes a lot of space)

Fixed speed issues in the Detail View caused by the quick filter. Let the Detail View update asynchronously to keep the GUI more responsive. Improved the speed of invert selection. Small painting speed improvement Improved the “get property from name” speed of Properties. Added a warning message and a “Show” button to the Properties View when more than 1000 nodes are selected. Greatly improved the speed & memory usage of the family selection actions. Performance improved when relayouting graph when transform results return (Mining view) Do not repaint links when associating MaltegoLink with yFiles edge (improves speed of transform results returned) Fixed bug where layouters continued when graph was closed Fixed Overview to update when the layout of the Organic Views change. Fixed Overview to update when the selection changes due to box selection or a change in the ExplorerManager selection. Run Smart Organic Layouter before Interactive Organic Layouter when more than 2k nodes changed. Improved speed of copy & paste (with links). (Big improvement) Speed Improvements to transform result merging. Let new entities spawn on-top of their parents instead of at the graph origin. Fixed multiple of the same transform messages showing in the output window. Fixed new entity custom icon always showing 16x16. When creating a new entity and the category have not been specified before finishing the wizard set the category to "My Entities". Small HTTP transform result processing speed improvement Do not close the graph when canceling the file browse save dialog after clicking the close button on a graph. Fixed bug where graph was still saved when clicking "No" on the overwrite file prompt. Hide the "Transformation type" page on the new transform wizard (for now). Show graph name instead of SaveCookie Java handle in saved status message. Let no entities be selected by default when exporting entities. Excluded the entity type from quick filter matches in the Entity List View. Fixed NullpointerException when trying to open the editor of a date property. Set focus to Graph View when syncing selection from Detail View. Set focus to Graph View after a find was performed on the graph. Set focus to Graph View after dragging an entity from the palette. Removed the "Add to palette" entry from the context menu. Zoom to 100% when double-clicking in Detail View to center on node. Added "Selection" under "Zoom to" ribbon menu button. Zoom to selection when syncing from Detail View. Zoom to selection when finding in graph. Show progress with aggregate progress bar. Progress indication is a lot more accurate (especially with many transforms/entities) and all transforms can be cancelled t once. Downside is individual transform progress bars are not shown and transforms can therefore not be cancelled individually. Use block layout instead of hierarchical layout after copying to new graph. Fixed rare ConcurrentModificationException when pasting. Fixed some copy & paste issues. (Not InterruptedException yet) Fixed IllegalStateException when calling new entity action. Transform Manager: Added delete option to context menu of Transform Servers. Transform Manager: Synchronize tabs when adding/deleting transforms or servers. Transform Manager: Removed "Copy" action for transforms. Removed "Description" column for seeds in the Discover Transforms wizard. Fixed load balancing issue where first server chosen was used for subsequent transforms even if the server does not have the transforms. Fixed IllegalStateException when working with the palette. Client now supports gzip compressed list transform responses Fixed exception (shown as empty message box) when editing any primitive array property. Fixed double[] properties being stored as float[]. Fixed floating point array property editor throwing exception when adding values. Replaced boolean "Port" property in Website entity with int[] "Ports" property. Fixed bug where default value of a property was lost during persistence if the default value of the property was the same as its corresponding type descriptor. Save find bar checkbox settings. Added "Zoom to results" checkbox to find bar. Fixed response code 400 from the server. Fixed exception when exporting entities on OSX. Set the xml "Value" entry of entities to not be compulsory and then remove entities which have null values from transform result. Without this change all entities are discarded because the xml parsing fails. Remove transforms not available on a TAS any more when rediscovering. Fixed progress bar and cancelling when starting transforms while other transforms are already running. Update the graph view when unfreezing a dirty view with pending new entities. Added a notification (like auto discovery) that fires when the graph is frozen and all transforms have completed. The notification has a link that updates the graph when clicked. Created a basic new entity wizard. Used as default. Advanced new entity wizard available from ribbon button drop-down menu. Set the default type for the main property in the New Entity wizard to String. Fixed progress bar staying at 0% when running a transform on more than 100 entities. Split the zoom to selection action from the "Zoom to" ribbon menu to its own button. Bound ctrl-shift-z to zoom to fit. Bound ctrl-shift-x to zoom to selection. Changed selected entities to be bright-red in the "sloppy drawing" mode so that they stand out more. Fixed Copy with links/neighbours in Detail View. (links were not preserved) Separated the idea of a "sample value" and "default value" for properties. Sample values only come from the palette. Default values are applied to properties when the property value is null (e.g. a transform does not return a value for the property) or when right-clicking in the property view and restoring the default value. For instance the sample value for the "First Names" property of a "Person" entity is "John" and for the "Surname" property its "Doe" but the default value for both properties is the default for a "string" property namely an empty string. Fixed Property View bug where calculated properties were not updated when changing one of the dependent properties. Fixed bug in the Property (entity double-click) dialog where calculated properties were not updated when hanging one of the dependent properties. Linked calculated properties to their dependent properties so that:- Calculated properties are recalculated when one of the dependent properties change. (Property view & dialog)- The dependent properties are cleared when setting the calculated property manually. (Property view & dialog)- The dependent properties take preference over the "value" property returned from a transform. If any of the dependent properties of the value property is returned then the value property uses the calculation instead of the value string returned. Changed all calculated properties to not be read-only by default. Split the value property into its dependent properties when editing the label of an entity. (when possible) Changed the CenterOnNodeAction of the Detail View to zoom to 75%, not 100%. Added a $trim() function to property calculations that trims leading and trailing whitespace and commas. $trim() the value properties of the Person, Location and PhoneNumber entities. Fixed "value may not be empty" error when running a transform that requires a string input that has not been specified. (caused by default/sample string value changes) Fixed image URLs after URL to FastURL changes. Fixed "Cannot find Java 1.5 or higher" error when launching Maltego in Windows with only the 64-bit JVM installed. Fixed the Maltego launcher to launch Maltego in the 64-bit JVM when a 32-bit and 64-bit JVM are installed. Build now also creates a 64-bit JRE bundled installer for Windows. Changed the installer to also check for the 64-bit JVM when using the 32-bit JRE bundled installer and a 32-bit JVM could not be found. Changed the installer to only check for the 64-bit JVM when using the 64-bit JRE bundled installer. Implemented a better fix for the Mac entity export issue. Changed WebTitle entity value property from “text” to “title” Removed 'formatted' field from PhoneNumber entity as it is replaced by the new 'smart calculated properties' Fixed URL images bugs. Fixed a bug in the loading of calculated property values when dependent fields are set. Zoom and center graph after "Clear All" action. Updated mappings of some rarely used fields of entities.

Yup, you get the idea. Lots and lots. Around the office we feel like we should really call this Maltego 1.0. We're very proud of 3.0.3. It's a milestone release.

More on Monday.
RT

Maltego Splash Screen Competition

2011-01-11T19:31:00.003+02:00

Hey guys,

Due to some inter-office disagreement (ED C'mon let's be realistic - mine WAS really better if you think about it now) regarding the splash screens we have decided to open it up to the public in the form of a competition.

Basically, send us your awesomely crisp 380x320 px splash screen that you think will suit our fantastic new performance release (3.0.3). In return, if we decide to pick your splash screen you'll get a free one year license for the commercial product and your art work will be the first thing anyone sees when opening Maltego!

Dust off your Corel, Gimp and Photoshop and send your splash screen(s) to splashcompetition@paterva.com

-AM

Paterva Christmas gifts - for real

2010-12-24T11:14:00.003+02:00

It's the 24th December 2010 - one day before Christmas. At this stage your mailbox is likely overflowing with silly corporate Christmas cards and special holiday offers that you don't really care about. We would like to present two real, free gifts for those that are still lurking at offices all around the world.

Gift A.1) A copy of Maltego 3.0.3 RC2 - not the final release, but damn close. You can download it [here]. It's a ZIP distribution, no install shield, but you'd be able to run it from the /bin directory. Remember - it's a beta. If you can't make it work - wait for the official release early in 2011 but keep in mind that the license key (B.2) will likely be used.

Gift B.2) A full, one year license key. Free. For a year. Yup. Here it is:
2607-1617-8614-4045-0807-7

You will be able to use this key on the official 3.0.2U1 client as well of course, and once we've released 3.0.3 officially it would be good to go with that too. It's strictly first come first serve, so dont' complain if the key aint working no more. That means you were too slow. Try again next year ;) Or better still, buy a real license!

In the next couple of weeks we'll start looking at what's new in 3.0.3 - what's fixed, new features and comparing performance with 3.0.2.

That's it for now. Enjoy the festive season and stay safe.
RT

Maltego 3.0.3 splash screen

2010-12-22T17:07:00.002+02:00

So, we've asked 5 people which one they prefer, and 5 people chose the red one. I hate the red one. It's obscene.

I made the grey one. Andrew says I am just pissed that nobody chose my design.

Totally obscene...

RT

Massive speed and memory improvements

2010-11-26T17:22:00.002+02:00

Today marks the last day of working on speed / load / memory improvements for Maltego 3.0.3. The rest of the time is dedicated to bug fixes. We think we're at the edge of the 80/20 boundary on this. And it holds true - in roughly 4 weeks we've made MASSIVE improvements on the speed and load performance of Maltego. 3.0.3 is FASSST. The last performance release I tested was blindly fast and yet we haven't looked at things like caching results, link compression and license key caching. So there is room to optimize even more.

I am super excited about 3.0.3. Even though there are no new features, it's something we should have done a long time ago. You'll see the difference straight away....

Transform Tuesday++ : Facebook,SOA,SPF and Shodan integration!

2010-11-24T11:41:00.022+02:00

Hey guys,

Transform Tuesday is here again! Sure it might be a Wednesday, but unfortunately the Fremont data center that two of our Linodes are hosted on went down yesterday (http://status.linode.com/2010/11/fremont-power-issues-rfo.html) !

None the less, there is a small possibility that it's Tuesday somewhere in the world, much like the fabled "it's 5 o'clock somewhere in the world".

This installment has a bunch of new transforms and I'm going to show off some that @achillean did integrating both Shodan and Exploit-db! Our transforms show integration with the Facebook graphAPI as well as some new DNS transforms (SPF and SOA).

Lets get to the good stuff!

Facebook GraphAPI:
I'd like to preface this by saying that we are not trying to break the terms of use of Facebook and we think that we completely abide by the principles listed on http://developers.facebook.com/policy/:

Create a great user experience

Build social and engaging applications
Give users choice and control
Help users share expressive and relevant content

Be trustworthy

Respect privacy
Don't mislead, confuse, defraud, or surprise users
Don't spam - encourage authentic communications

However if we are asked to take down the transforms we will of course.

What are the Facebook transforms?

toFacebookObject - search Facebook via the graphAPI and return the results. Think of this as your Facebook search engine transform!
toFacebookAffiliation- convert the above objects to to a Facebook affiliation with the profile picture and a link to the profile.
toPhrase - try and extract the phrase from the Facebook object (what the status message was).
toPersonFromProfile/toPerson - extracts the person from the Facebook object that made the post so you can use this with the normal people searching transforms.
toEntitiesNER - take the phrase from the Facebook object and try and extract terms/locations from this.
toFacebookObjectPerson - simply search Facebook for this person's name.
toEntitiesNERTwitter - technically not dealing with Facebook, but also allows the same functionality as the above toEntitiesNER transform - but on tweets!

A quick example:
So let's take a look at the phrase 'TSA' on Facebook. Simply drag a phrase onto your graph, set your slider to 255 (3rd notch) and run the 'toFacebookObject' transform. You should see results like this:

Next you can take all of these entities to other entities with the use of Named Entity Recognition (NER) via the 'toEntitiesNER' transform. This will try and extract things like Companies, Locations, and other entity types from the messages. NER is not perfect, as you will notice things like 'Pat Downs' as a person. Keep in mind that NER is very difficult to do! However you can immediately get some results from what is being said in the public Facebook space, such as:

From the screenshot above you can see that the term has connections to the US, deals with two agencies and Mr 'Pat Downs' - someone I think many people can now relate to at this point in time!

Other things you can do is take each of the facebookObjects to Person entities so that you can then perform other searches on these people or identify people commenting a lot on the phrase you originally searched for. To do this you can simply select all the facebookObjects as before and run the 'toPersonFromFacebook' transform:

So why are these Facebook transforms useful:

Tracking spam: you can use a phrase that you know is used in spam, take this to facebookObjects, then take each of these to a phrase ('toPhrase' transform), and then again search Facebook for these phrases, rinse and repeat until you have identified all the spammers.
Tracking what is said about a specific term (and who says it the most) as well as how often they are talking about and who they are. You can also identify locations/companies/other useful information by taking these objects and performing Named Entity Recognition on them.
If it was possible to identify friends of an individual (think the typeahead bug) you could identify the spheres of influence around people on Facebook that you have found via your graphAPI queries.

How to get these transforms:

Entity: http://ctas.paterva.com/TDSTransforms/GraphAPI/facebookObject.mtz
Seed: https://cetas.paterva.com/TDS/runner/showseed/SocialMedia

SPF/SOA Transforms:
Recently the topic of spam came up in the office and why SPF(txt) records were never implemented - they seem to be a viable means to stopping spam. We looked at the implementation a bit and noticed some very cool things, such as:

Admins are lazy and want the ability to move their mail servers around so they give their entire IP range in the SPF records
SPF records often include other SPF records which show other domains relating to the one you are interested

Secondly a transform RT has always wanted has been one that looks at the SOA records for domains to get the zone's administrative email address and the primary name server (where the zone was created - this is not necessarily one of the current nameservers). These transforms often provides information that's not found in the normal enumeration process.

We have developed two transforms specifically aimed at these:

DomainToSOAInformation
DomainToSPFInformation

Hereby some examples of using these transforms:

SPF Transform:
Compare the NS of pentagon.mil (left) to the NS found in the SOA record (right):

SOA Transform:
Quickly and easily identify Google's netblocks from their SPF records:

These transforms have been added to the standard infrastructure seed which can be found at: https://cetas.paterva.com/TDS/runner/showseed/Infrastructure

Shodan:
This week there has been a lot of coverage of the Shodan transforms, developed on the TDS. The transforms essentially allow the integration with the fantastic shodanhq.com as well as exploitdb.com.

The transforms are as follows:

searchExploitDB - Search the Exploit DB archive's exploit descriptions.
getHostProfile - Returns the list of banners for the given IPv4 as well as general host information (hostname, location, etc.).
searchShodanDomain - Search the Shodan database for information on the given domain name.
searchShodanNetblock -Searches Shodan for hosts contained in the given netblock.
searchShodan - Use the Shodan search engine to locate computers.

Some examples:
Identify hosts belonging to google.com:

Drag the domain google.com onto the graph and run the searchShodanDomain transform or run the searchShodanNetblock on one of the netblocks found with the SPF transforms (see earlier):

Verify these results by running the getHostProfile on one of the returned IP addresses:

Search for host responses with the word 'scada' in them by dragging the phrase 'scada' onto the graph and running the 'searchShodan' transform:

Identify Vulnerabilities that have 'scada' in the name or description by using the same phrase and running the 'searchExploitDB' transform:

Overall these transforms are awesome, and it is great to see people building (and releasing) transforms via the TDS! Hopefully we can see improvements on these such as:

Ability to search the returned banners against exploitdb
Ability to search the builtwith.com results against exploitdb
Exploits with a link to where one can find the specific exploit

Where can I get the shodan transforms?
The Shodan transforms can be found at http://maltego.shodanhq.com/

Finally, apologies for the Goliath of a blogpost. When I started it this morning it didn't seem like that much, but it's grown quite a bit. Special thanks to the Shodan guys for developing some awesome transforms.

Damn the man. Save the Empire.
-AM

Maltego 3.0.3 is looming

2010-11-20T11:57:00.003+02:00

3.0.3 What's in there and when it's released
Maltego 3.0.3 will be released before the end of this year (or perhaps in the first week of 2011). There is good news and bad news. The bad news is that 3.0.3 will not really have any new features. The good news is that it is a 'performance and stability' release. Which means - it will be fast. Very fast. And stable, very stable.

We've been working for the last 3 weeks with one goal in mind - making Maltego work better with large graphs. The target is to comfortably work with 10K node graphs on a 1GB JVM and Dual Core processor. And we're getting there. Of course, if you happen to own an I7 with 8GB of RAM, your experience will be much better and you'll be able to handle many more nodes. The side effect is that smaller graphs will be super fast to navigate, select and run transforms on.

We've also made a list of 'well known bugs' that have never made it to the priority list. Things that irritate us but that we've learn to live with. Many of these will be squashed. It's just that time now - time to grow up and fix it. It's hard to not add features - there are so many that we all want in Maltego.

New transforms coming + Shodan transforms
We are also releasing some new transforms this coming week. We've been sitting on a couple for a while and now it's time to make them public. Lastly it was GREAT to see that the folks of Sodan have adopted the TDS and made some transforms. This is exactly what we had in mind with the TDS. You can catch all the action at [http://maltego.shodanhq.com]

Crisp out,
RT

New infra enum transforms - with sweet example

2010-11-09T20:40:00.019+02:00

We're happy to release a couple of simple transforms via the TDS that assist with the foot printing / enumeration of infrastructure. These are:

NetblockToNetblocks

Essentially this transform breaks large networks into smaller chunks of networks. This is useful when you have transforms (such as reverse DNS, portscans etc) that only works on class C networks...and you are stuck with a class B.

NetblockToIPs

Shows every IP within the netblock as a separate IP address entity. Useful when you need to run a transform on an IP address itself, and want to repeat the process over all the IP addresses in the network. An example of this will follow.

WebsitetoDNSName
NStoDNSName
MXtoDNSName

These transform simply converts the NS,MX or website to a DNS name so that the enumerate numerically transform can work on it. In other words - see the next transform..

enumerateHostNamesNumerically

This transform will test for the existence of DNS names that end with the same name, but another number. As example - if ran on mx1.domain.com it will check for mx1, mx2, mx3.domain.com. The range and padding can be set with transform settings.

Examples

How is this interesting at all (because frankly, on the surface it looks pretty boring) ? Let's look at examples. Let's assume we are are foot printing a domain called eop.gov (if you missed that class - EOP is the Executive Office of the President - which, network wise, is a lot more interesting than whitehouse.gov). We run the 'Find common DNS name' transform on this, and end up with a graph like this:

Clearly ns1 is a good candidate to be enumerated numerically. And so we shall:

The transform will ask us for some transform settings:

And ends up producing a graph looking like so:

With a couple of more transforms, a little re-arrangements and manual linking we get:

The resultant DNS entries (at the bottom of the screen shot, and produced by looking at reverse DNS within those netblocks) also looks yummy for numerical enum, so we'll run them too (but perhaps from 0 to 99 with one digit padding). You end up with graph looking like this:

In the end we'll take all of the DNS names, copy them to a new graph and resolve them to IP addresses. This gives us:

For the next step we'll use one of the other new transforms. We'll take the two blocks, and enum them to individual IP address entities. Why? You'll soon see. But first, this is what it should look like:

The blue dots are the IP addresses. The 'hands' sticking out at the sides are IP addresses that were discovered from two transforms, resolving the DNS names, and the enum. Sonowwhat? Now, we'll put every IP address into a search engine and see if there is any results. EH? Well, when anyone browses the 'net the site that they browse probably records the IP address in a log...and sometimes, just sometimes...those logs get index by a search engine. So - we end up with a graph that gives us a list of websites that were visited by that IP address. You might think it does that happen a lot - but you'll be surprised. Hereby the resultant graph:

The blue dots are IP addresses, the pink ones are websites where that IP address was found. This is the edge weighted view, so the larger the sphere, the more IP addresses pointed there. Of course, IP addresses don't just end up in logs that gets indexed. This closeup shows you why:

In fact, the more interesting sites are the ones that are only visited once or twice. We can also weed out the false positives (sorry Rob, in this case that's you) by searching our graph for words like 'usage stats' and the likes. The results then start looking a lot better - here is a small portion of the graph:

In the detail view we can see when and what were visited:

If you missed the point of this whole mission - it was to see if we can figure out to which web sites the people in the Whitehouse browsed to..

Anyhow - this was just a *brief* idea of where you can go with these transforms. On their own they are boring and bland, but when used with others they sparkle.

OK, initially I thought "brief" and then I ended up spending 45 minutes on it (most of the time copy and pasting the graphs, cropping them and struggling with this web interface blog editor).
Also, before I forget, and your reward for reading all of this - the seed for these transforms can be found here:

https://cetas.paterva.com/TDS/runner/showseed/Infrastructure

You may use instructions on [this blog post] to see how to get these into Maltego. They don't need any special entities. So it's load, discover and play.

Crisp out,
RT

Free BuiltWith.com Transforms!

2010-11-09T18:43:00.018+02:00

Builtwith.com is a fantastic site for enumerating technologies used on a website, things such as JQuery, Google analytics and additional server information such as the type (Apache/IIS).

For example, if you had to perform a lookup for www.paterva.com/web5/ you will receive a results page (as seen on the left). This page includes that our website uses/is run on:

Apache
Ubuntu
Mod_SSL
JQuery
Google Analytics

But why Andrew, WHY?
So out the bag this may not seem that exciting, anyone could simply go and have a look at the source of a website and look for keywords relating to the technology, or even look for key directories (Wordpress' /wp-admin/ directory for example).

However imagine you were looking at a large number of websites, in this example gov.za space ( I placed a domain 'gov.za' onto my graph and then ran the "To Website DNS [using Search Engine]" Transform with my slider set to 255):

How would you correlate which technologies were being used with which websites? Well simple, with Maltego of course (and a bit of code to integrate with the BuiltWith.com API)!

The next step would be simply to select all of the websites found and run the "ToServerTechnologiesWebsite" transform. This will then return the technologies used for each site as seen in this example with just 1 website:

You would then run this across all of your websites to view what kind of technologies were being returned!

Initially we noticed that there was a lot of excess data coming through, technologies such as Javascript, CSS and SEO_H1 which we have since discarded and are only looking at results in the following categories:
"cms","framework","server","Apache Module","Database","Hosting","Interent Communication Server","J2EE Server","Security","Server","Web Accelerator","Web Host","Web Master","Web Server","Web Server Plugin","Web Technology","analytics","javascript"

If there are others you would like to see from the API ( http://api.builtwith.com/ ) feel free to let us know.

So where to from here?
Well now that you have a list of all the technologies used you can see interesting correlation between the data, such as:

Are all the websites running the same technology or are there odd cases, and if so why? (Does some dev have a machine running thats accessible from the internet running a vulnerable server)
Is the infrastructure mostly Windows or *nix based? (Apache vs IIS)
Which CMS' are used, and where? Are they all the same or are there variants?
Which websites need their technologies upgraded!
What is the most common technology used between all the websites?

Show me the money!

In edge weighted view we can quickly identify the most common technologies used:

And by using the Entity List view I can easily identify the top used technologies by searching for 'BuiltWith' (its the type) and then sorting by incoming links:

Give me the Entity and the Seed!

Entity: http://ctas.paterva.com/TDSTransforms/BuiltWith/BuiltWithTechnology.mtz
SeedURL: https://cetas.paterva.com/TDS/runner/showseed/builtWith

You can follow our previous post on importing these here: http://maltego.blogspot.com/2010/11/transform-tuesdays-free-maltego.html

Last but not least
I'd just like to send out a thank you to Gary Brewer from BuiltWith.com for some changes we requested to do HTTPS as well as HTTP and for helping us out generally with our BuiltWith.com queries!

I'd also like to point out that these transforms run on not only a website but also an IP address as well as URL. Please also note that BuiltWith.com does not currently follow redirects so it will simply try connect to the website, IP address or URL and return the information based on that single page (no spidering).

We look forward to seeing the community respond with more transforms like this!

Transform Tuesdays! Free Maltego Transforms!

2010-11-09T17:49:00.009+02:00

Yes, it's not nearly as popular (yet) as Patch Tuesday, but at least it's an alliteration.

We have been working on a bunch of new TDS based transforms that we would like to share with the community in the hope that the community responds with more transforms of their own.

Today we will be releasing two sets of transforms:

BuiltWith.com integration via their fantastic API
Enumerate server side technologies of Websites and URLs. These include things like CMS (Joomla, Wordpress), Server information (Apache, IIS) and other technologies used (Jquery, Youtube, Silverlight, etc)

Various useful infrastructure transforms
Couple of transforms to help with infrastructure enumeration including Netblock to IP addresses and Netblock to Netblocks.

How do I use these Transforms within Maltego?
You will need two things to use any of the upcoming TDS transforms (and any we post in the future).

Maltego Entity Objects file (mtz) with any custom entities that are used for these transforms. NOTE: This is only needed if there are custom entities.
Seed URL: This will point your Maltego interface to where it can find new transforms.

Enough! Show me with pictures!

Importing custom entites (Where needed)

Click on Import Entities

Select the supplied Maltego Entity Objects file (mtz)

Select the entities you wish to add

Add it to a group

Enjoy your crisp new entities

Discovering Transforms:

Click discover transforms

Add a name for your seed and the supplied URL

Neeeeeext

Neeext

Neeeext

Finished! You now have some crisp new transforms!

In the upcoming posts we will release the mtz as well as the Seed URLs for the new transforms.

Maltego 3.0.2 is live!

2010-10-27T20:28:00.004+02:00

So, there we go. Maltego 3.0.2 is out - and - finally - we have an OSX release too. In terms of functionality it's about the most we've done in a minor release. I think it's a pretty release. You can find it on the web site on the [download page].

The other news that's really exciting is that we *just* heard we are training at BlackHat Federal in Washington DC. Woot^2! You can check out our course outline ---> [here]. More on this later.

Enjoy responsibly!

Maltego 3.0.2 is here (soon..really soon)

2010-10-27T14:53:00.013+02:00

Hey Guys,

We are at the stages where we are finally starting the build processes for 3.0.2 putting out deb's, rpm's and yes even an OSX dmg !

There are some fantastic new features in this version including:

Labelling, Colouring and Styling links
Path Selection ( find paths between two entities )
Entity and Link selection modes
Selecting of similar nodes
Copy and Paste between graphs (With and without links)
Copy to new graph (with and without links)
Copy to new graph with Neighbours/Parents/Children and the depth of that
Various bug fixes
Improved performance with links

The dev team has really put a lot of hard work into this release and it really shows!

In other news we have also been working on some new transforms to be released via the TDS at some stage ( most likely next week ) which will include the following:

Netblock expansion - take a Netblock to the IP addresses within it
Numeric hostname enumeration - enumerate hostnames numerically (so from mail.domain.tld look for mail1.domain.tld-mail99.domain.tld), with padding and so on
BuiltWith.com technology lookup - look up the various technologies used on particular websites (apache/jquery/joomla/etc)
Facebook GraphAPI Searching - lookup what has been said in the public space on facebook via the graphAPI ( think posts/videos/links ) and who said it!

And without further ado, a screenshot showing some of the built with and the new links!

Lastly, a special thank you from all of us over here to Nadeem Douba who really pulled through for us helping with the Mac release! Thanks guy!

And now back to building! Downloads soon!

-AM

*UPDATE* you can grab the addendum at http://www.paterva.com/docs/3.0.2.addedum.pdf

3.0.2 is delayed by one week

2010-10-19T14:06:00.003+02:00

The 3.0.2 release is going to be late. Yep - can't help it. It was supposed to be out by the 21st...but we've run into performance issues - specifically because links now carry loads more data information.

The plan is now to get it out by the 27th - a week later. And yes, we still plan to have the OSX release ready by that time too. So, just hold on a bit while we get 3.0.2 ready for you.

3.0.2 release schedule ...and more

2010-10-04T11:36:00.003+02:00

It's been a while since I posted to the blog. I was secretly hoping Andrew would make a posting...tsk tsk - the youth of today!

Many things happened since the last post. I spoke at Ekoparty - it was a blast (see attached photo). Also we are hard at work at 3.0.2. The good news is that version 3.0.2 will also include an OSX version. That's right - an OSX version. For the Mac.

Version 3.0.2 focussed on making manual linking easier. We have line style, color and thickness now..and labels. Oh and copy and paste will work as advertised in 3.0.2! I've attached a screenshot of an early beta of 3.0.2.

The only question is WHEN? At the moment the release date for 3.0.2 is pegged at 21 October - that's around 3 weeks from now. Let's hope we make the deadline!

Transform Distribution Server (TDS) is live!

2010-08-18T12:02:00.005+02:00

We've been way busy getting the TDS ready - in the last couple of days we've created 4 videos of how the TDS works and what you can achieve with it. The last of the videos uploaded some minutes ago. You can catch them all [here].

The TDS gives everyone the ability to integrate their transforms with Maltego - without having to do the hard work yourself, but with the flexibility of having your own server. Combined with the ability to build and share custom entities we think it is a pretty powerful concept...

You can register on the TDS [here] and the documentation and libraries can be found on our website over [here].

Feel free to register and play around - and do gives us your feedback!

3.0.1 Commercial - bugs fixes, features and dates

2010-08-04T13:54:00.004+02:00

Maltego 3.0.1 Commercial edition release is due soon (hopefully next week). This version will see the following bugs fixed:

Black icons (after some idle time)
Transform cancellation now works as expected
Matching rule on entities is sorted out
UI state is kept after restart
Stability issues, cosmetic and 'small bugs'

The following features have been implemented in 3.0.1:

Printing of graphs (also to PDF, multi page)
Custom transform images now in categories
Export to PNG (& setting the output resolution)
Reporting (think 'turn my graph into a 400 page PDF document')
All entities in palette (for when you want to use manual linking)
Automatic periodic transform updates (so you'll see when a new transform is available)

3.0.2 focus will be:

More control and options on manual linking of nodes
Annotation of entities and links
Copy and paste

3.0.3 focus (we think/hope) will be:

Importing of local data (CSV and friends)

Lastly - TDS. It's coming soon...

Security Year End Function

2010-07-22T11:58:00.003+02:00

BlackHat Vegas is upon us. Sadly we won't be there...but Maltego will be! We know of the following places where Maltego will be shown:

Offensive Security Training (Pentesting with BackTrack)
Suggmeister (Chris Sumner)'s talk - Social Networking Special Ops
At the HBGary kiosk - and in Greg Hoglund's talk- Tracking Cyber Spies and Digital Criminals

Also - for the duration of BlackHat and Defcon as special offer - use the coupon 'BlackHat' and get 25% discount on Maltego licenses.

If you see Maltego in any other talks or training - let us know. Yes! Soon we'll have MaltegoCon - hee hee...;)

Maltego at a printer (or PDF) near you...soon

2010-07-19T14:33:00.001+02:00

LawTrust/ Entrust - thanks!

2010-07-15T08:48:00.004+02:00

Due to the fact that Thawte took their sweet time to get our certificates sorted out, we decided to look at the local crowd LawTrust to get our other certs. What a pleasure - got it in one day. It helps that they are based here in ZA. Thanks Megan/Chantell/Christi/Maeson - you rock!!

We have valid certificates now..

2010-07-14T18:32:00.001+02:00

So there...no more self signed.
CETAS and Alpine will follow soon.

Growing up..

2010-07-11T18:21:00.002+02:00

Soon we'll have board meetings too... :(

CE is live!

2010-07-08T22:23:00.002+02:00

Hey guys,

Finally I get to post something on the blog! We have been working very hard (and even harder this week with me going on holiday tomorrow!) and for once we have released ahead of schedule!

Thats right, the fantastic new Maltego CE is here. We have given a lot back and most of the limitations have been cut back plus we are working on some really new exciting stuff for the community (container TAS).

Thanks for all your support and comments - we really appreciate it.

See you on the 20th :)
-AM

Community edition and HITB feedback

2010-07-08T10:07:00.002+02:00

It's been a while. Came back from Amsterdam a few days ago where I presented at Hack in the Box (HITB). It was really a cool conference (thank Dhillon/Amy and the rest of the team!). Not too many people, not too few. Really nice vibe - and it was good to be back in the Kras. Made some new friends and got to see many old ones again. It was good.

We are releasing CE edition of Maltego tomorrow unless there's a major train smash. We've made CE3 less restrictive - the hope is to get a lot more of the community involved. Hopefully we are not shooting ourselves in the foot in terms of funding for more development (yea - version 3.1 is looming in the distant future).

Soon after the release of CE we will also release CCTAS - those that saw the talk in Amsterdam will know what's potting (excuse the pun). I showed a short video of where we are going with that. The bottom line is that it will allow the community to write and host their own transforms - and the client will automatically update transform list as we go along. Exciting times for sure!

Will keep the blog updated for the release - watch this space!
Now - let's get the show on the road - 'latererer...

There IS life after 3

2010-06-21T11:14:00.005+02:00

Last week saw the release of Maltego 3.0 and the new website. Stress levels are slowly returning to normal...

It went fairly smooth - just took a long time to upload everything and we missed our official deadline with 2 hours and 14 minutes. Not bad considering a 15 month wait. It was the Maltego+JRE (40MB) upload that killed us. Oh and the fact the the debs and rpms said 'Maltego 3 Beta' and we had to rebuild them. Funny thing - 5 minutes after the last upload was done the power died and we sat here in the dark. If it was 5 minutes earlier I would have cried lots...but it wasn't. After that was post 3 release celebrations with good food, good beer and finally - good sleep.

So far there have been 2 little problems (which we sorted out). The first has to do with licensing - a small number of users have been affected in a way that they need to activate the product every time they reboot. Bleh. Fixed. The other problem had to do with authenticating proxies. Seems the dialog that asks for creds was incompatible with what we were using. But that's solved now too.

We are currently uploading the new build - so if you experienced any of the above problems you should just grab a new copy (in a few minutes - let's wait for the upload to be done).

In just more than a week's time we are speaking at Hack in the Box in Amsterdam. Should be fun. If you are around, come say hi.

Oh, and over the weekend I installed new lights in the office. And more heaters, a fresh cat blanket and more cups ;) See...even after the big 3 release ... life goes on.

Maltego 3 was officially released 10 seconds ago

2010-06-15T18:14:00.003+02:00

Maltego 3 is up. We're there. It's happened.
Website up & running...enjoy!
http://www.paterva.com/

Release is today at 16h00 GMT+2

2010-06-15T09:33:00.005+02:00

Finally we are releasing. Today. In a few hours. Just putting the final touches on the website and re-testing all the installs. It also means you have about 6 hours to still buy licenses at the old price.

We are all a bunch of nerves. I hope all goes smooth. Next time I write Maltego v3 will be out there in the wild...eish.

Tomorrow!

2010-06-14T08:50:00.002+02:00

The release is tomorrow. Tomorrow. After 15 months the release is TOMORROW.

We are fixing the last of the (obvious) bugs. I am pretty sure there are still a couple left - in a system as complex as Maltego 3 there will always be something that's itching. But mostly its all systems go. I must say with everything coming together v3 is one sexy beast. It really looks and drives super slick. Won't be missing v2 soon..

Today is going to be a looong day. Getting the site sorted, testing and retesting the release. The vuvuzela people woke me up at 6am and there was no more sleep - just thinking of all the things we still need to (and can) add to make v3 more special.

Tomorrow there will be a final post as v3 go live...

Almost...

2010-06-11T15:05:00.006+02:00

Nerves. Redoing the website. Fixed two transforms that were unstable. Changed transform descriptions to make it read nicer. Worry about next week. Prepared dedicated M3 server. Payment gateway tested.

Oh and kickoff for the World Cup is in 45 minutes.

Chinese hackers

2010-06-10T10:27:00.003+02:00

Getting the server ready I was making sure that we have Unicode on the server side ready as well. I did mention we have Unicode support in v3 right?

This is Google's translation for simplified Chinese of the word 'hackers' in Maltego + 12 sites containing the word:

Less than a week to go..

2010-06-09T21:04:00.002+02:00

With less than a week to go for Maltego v3 it is tense times all around. We ran into a nasty bug that needed sorting - e.g. a deal breaker. It finally broke this afternoon. Now we can keep on working down the list of known bugs.

We decided to have a dedicated server for v3 and phase out v2 as we go along. This makes it a easier to migrate existing users to V3, but it means a bit more work this side.

We're also working on a new website. Anyhow - more as we go along...

SQLTAS v1.0 - what a mission!!

2010-06-02T11:45:00.004+02:00

We're done! The new SQLTAS is ready for beta testing. We've had all our days getting the Oracle and DB2 ODBC drivers working but it's all in the past, and we're in beta testing phase...with 1 tester. They're a pretty demanding client - linking between four different databases on two different DB platforms. Let's hope there are not too many issues.

After the 3.0 release we'll spend more time on this and roll it out to all server clients. For now - it's all engines firing for the 3.0 release on the 15th.

Oh - the cables (DSL) have been restored after about 10 days of downtime. The USA soccer team (think World Cup 2010) is staying a couple of blocks from the office- they arrived yesterday. Funny - I wonder if this is a coincidence.

Licencing implemented

2010-05-31T16:22:00.002+02:00

As per schedule the licensing for Maltego 3 is sorted. This means we are fairly on track with the schedule. This week we start with cleaning up bug / interface / cosmetics. There are MANY things that are still VERY wrong.

I am guessing we'll end up with a 3.0 on the 15th and a 3.0.1 on the 1st of July. Question is - do we make 3.0 commercial bug free, or do we spend time building 3.0 community edition? Hmmm...priorities...

So far so good

2010-05-21T18:26:00.002+02:00

Local transforms are working in v3. It will be using the v2 specification...for now. In 3.1 we'd like to extend it to be able to use the v3 protocol, but for now it's going to have to roll with v2 protocol. See, me talking about 3.1 and we don't even have 3.0 out the door. Tsk RT..

We're on track...next up is licensing.

Pricing and upgrades

2010-05-20T22:24:00.002+02:00

A lot of people have been asking about the pricing and upgrade path to V3 - so I decided to put something out. For now the idea is going to be like this:

V3 will be around $650. We're not 100% sure on the number. AM says $750, but I think it's too steep for end-users. We've had the price pegged at $430 for V2 for over 2 years, and with all the extras coming in V3.0 and V3.1 as well as inflation I think 650ish is fair.

The good news is that valid license holders will get a free upgrade to V3. That means, if you buy now you pay $220 less than if you buy when we release in June. Also, if you are a valid license holder, subscription STAYS at $320 per year and you'll be automatically upgraded. In others words - hang on to your license if you have one.

Wow - I sound like a proper sales person....how freaky...

Load and Save is working!

2010-05-17T13:33:00.002+02:00

So far, we're on target for a 15th June release. Last week 'Save/Load' was implemented. The file extension is called MTGX - a zipped file that contains the graph (in GraphML with Maltego extensions) and the entities - even custom entities. The file can also be used in the Entity import function. That means you can share you custom entities by simply sharing the file..

Before the end of the month we're looking for licensing and local transforms (v2). That means we get 1 week to sort out silly bugs and cosmetics and 1 week for packaging / documentation (BLEH) and getting the website ready.

Meanwhile we're also hard at work on the SQL TAS - idea is to have it ready with v3 around the 15th too. Exciting times!

SQLTAS - coming soon!

2010-05-14T17:34:00.003+02:00

Hey guys,

We are working on an awweeeeeeesome new SQLTAS, here are some tasters!

-AM

RT's Birthday

2010-05-14T17:27:00.002+02:00

Just wanted to send a shout out to RT for his birthday today, may it be awesome!

-AM

Release schedule

2010-05-04T11:23:00.002+02:00

After Brazilian people asked us when Version 3 is going to be released we finally decided to put a date to it. It was hard to do this. Here is the release schedule (subject to change of course):

May 2010: Adding save/load, licensing, local transforms to what we already have. Note - local transforms will just implement the v2 specification (not the glitzy v3 protocol).

1 June 2010: Bug fixing, small 'popkak' issues, rounding off, cosmetics etc. During the second week we will probably open up for public beta.

15 June 2010: Commercial release of V3.0

16 June 2010: Work on community edition starts.

1-14 July 2010: v3 Community Edition (CE) released.

August 2010: Work starts on 3.1. A lot of the really cool stuff we wanted to put into v3.0 is just not going to make it in. We could be working on v3 until the end of the year if we keep on putting new features in there - this while nobody can use *any* of the current coolness we already have.

So - I have decided to call a date / draw a line in the sand. The current idea with v3.0 is that it will not be able to harness the power of the v3 protocol but rather work with v2 servers and v2 local transforms. Having said that - we're in the process of rewriting parts of the server platform.. watch this space.

Video - shown at BlackHat - NER within Maltego

2010-04-29T12:56:00.003+02:00

This is one of the videos we've shown at BlackHat Barcelona. It shows how well the new Named Entity Recognition (NER) transforms perform.

We start with a phrase ('uranium enrichment'), then look at PDF documents containing the phrase, run the OpenCalias and Alchemy API for NER on it, ending up with a graph that shows person's names, locations and companies - all in a Edge Weighted View (EWV) graph with referring URLs. Finally we compare the top locations found with what's listed on Wikipedia. The video is rather large (150 MB) but shows Maltego v3 in HD and should be worth watching.

The NER transforms are currently available on both the commercial and community Transform Application Servers (TAS) - you just need to follow the transform discovery wizard to get them.

Have fun and if you have a lot of fun - take photos...;)
RT

PS: yes - some parts of the video have been sped up to avoid boredom and a larger file.

Back from BH Barcelona - at last!

2010-04-22T23:15:00.003+02:00

Finally back after hectic delays. Expect more posts in a few days. We're looking to redo the SQLTAS...hee hee. Going to be interesting!

Oh and - we're putting up the videos I used in the BlackHat talk soon. If you are impatient, drop us a line...

RT

BlackHat EU - weather and so

2010-04-15T10:21:00.002+02:00

Barcelona is cold and rainy and has a pretty nice Metro system. Talk went OK - got some coverage on Twitter. Meanwhile Chris from Social Engineer did a quick writeup of V3 - thanks for waiting for the talk to finish Chris.

Link to summary of the talk here.
Later more.

Spain!

2010-04-12T10:55:00.003+02:00

Leaving for Spain tonight. If you are at BlackHat Barcelona come say hi. Showing all things version 3, so if you want to see how it's progressing be sure to catch the talk.

Now I need to get packing...
RT

BlackHat EU paper in - betas out...

2010-04-01T14:07:00.002+02:00

Just sent my paper for BlackHat Spain - 14,15 April, Barcelona. Will be showing Maltego version 3.0 with NER and some other interestingnesses. Hope the audience enjoys it.

On another more emotional note - we've sent out preBeta releases to 10 people yesterday. It was very hard to do. Feels like you are asking a motorcycle gang to watch over your 2 year old daughter for a weekend. Let's just hope they are nice to her. I sometimes think that Maltego 3 will never be ready to face the cruel world out there (that's you!).

Anyhow - the preBeta release is very spiffy. All the v2 entity mappings are sorted out - meaning all the transforms work. Also Chris and his team managed to include the old views and layouts (+ of course the new stuff). All and all its a nice release. The next big step would be to start working on the v3 server, local transforms, save/load and licensing.

More later...

Labels on EWV lives!

2010-03-30T23:18:00.002+02:00

Finally, after a bug in the graphing library was solved we have labels on Edge Weighted View! And I must say, its look pretty sexy. The sizing and spacing is also adjusted, so that entities are not so cramped.

InfoPorn

2010-03-19T18:06:00.004+02:00

These are some of the things we are currently working on...

NER (Named Entity Recognition)
Dynamic graph update in v3
New detailed view
New edge weighted view

We decided to roll it into a nice little video:

For the video we looked at the term "Chris Roper site:za" (he is a journalist here in ZA), then took that to websites (where his name occurs), then to URLs and finally let loose the NER stuff on every page. It's super cool to see how the entities starts gathering around common people, organizations and locations...well - I love it!

Now it's weekend time!
RT

Free Icons!

2010-03-19T17:01:00.003+02:00

So within the entity creation wizard we have decided to start including a whole bunch of our own icons from our libraries. This is primarily so that when people start creating their own entities within Maltego there are some 'stock' icons to use that look great on the graphs!

Step 1 within the entity creation wizard

After clicking on browse you can now either use the stock icons or your own!

Our little universe

2010-03-12T17:45:00.004+02:00

Phrase "Maltego" -> Websites -> URLs -> [NER Magic happens here] ---> Pic on the left!

This week's update

2010-03-12T17:00:00.003+02:00

We've sorted out the memory issue! It's in the past now...I think..I can't remember. Har har. Unique entities per transform is also done and thus layout issues we've had (think double links to entities and links not moving with entities when you move them around). An icon browser for the custom entities is in the works and next week they tackle licensing (this means we can actually push the client out to people). The v2 to v3 conversion is done - so you'll be able to use v2 servers with v3 client without a problem.

Server side me and Andrew took a fresh look at the NER stuff. It's super exciting and we think we have something that can really work (without frying our servers' CPUs). It takes a long time to test and tune, but I am confident that we'll ship it with v3. Yipee!

Freeze/Unfreeze

2010-03-08T12:27:00.004+02:00

So the weekend is over and i figure its probably time i gave you a bit of an update before this becomes RT's Maltego Blog!

I often get frustrated at graphs moving around the whole time when the nodes are coming in and also the 'crunch time' required to rework the layout every time 1 node comes in when i have say another 100 still yet to arrive.

So bring in Freeze/Unfreeze! A nice little button near the view buttons where you can pause the graph layout, so it basically just holds your graph as is ( Note the button greyed out next to the freeze button ).

When new entities are ready to come in you can then the previously greyed out button becomes a green 'refresh' icon as you can see below.

So essentially now instead of watching the entire graph update i can wait until all the transforms are completed, and click the 'Update graph' button and have all my entities displayed out in one go:

Also, those new icons are looking awesome!

-AM

This week's progress

2010-03-05T13:29:00.002+02:00

Made a 12 minute presentation for a large social network on Maltego 3 this week. Spent a lot of time tweaking specific things to work for the video. Think matching rule compatibility between 2 and 3 (Chris had to build a converter) - hopefully this will help us not only for the presentation, but also for people wanting to use v2 servers with v3 clients. Had to hack the slider in there too, as our client was limiting to 50 results. With more results we had to find that memory problem (as our graphs were exploding). It's still not 100% fixed, but at least now we can work with larger graphs.

Making the video was horrible. I hate hearing my own voice and seeing my own face. It's hard - hopefully I am over it now and can move along.

Memory problems Bgone!

2010-03-03T13:20:00.003+02:00

Chris found the bug! It's not fixed yet, but at least we know where to look. Meanwhile a workaround release was built. This allows us to test with larger graphs - see below:

Icons = Win

2010-02-24T17:30:00.004+02:00

This release is looking absolutely smashing! Definitely starting to see the light at the end of the tunnel, whole bunch of new features and the new icons have made a huge improvement.

Added in things like search, alphabetical listing of the transforms, cool new transform view properties (ie, change the icon of a website to the site for only a few, or set it to show pages rather than just the website - more on this later), plus a ton of new stuff its really starting to all come together.

Here, have some screenshots :)

Loving that, Party boosh!

24th release

2010-02-24T17:15:00.002+02:00

Looking gooood! Link highlighting is back in and finally we have find in as well. Things are starting to get together now. Detail view is nicely keeping state and looking really sweet. The entire look and feel of v3 is awesome.

Chris is still chasing the memory bug, so can't really build huge graphs. My hope is that the client performs as well with larger graphs. We'll see when we get there. Andrew's choice of icons proved to be well worth the wait.

We won.

2010-02-23T10:40:00.002+02:00

Seems the old version of Maltego is still kicking butt..this makes me happy.

Detail View Update

2010-02-22T14:29:00.002+02:00

Just to give you guys a quick update, the latest release i've just been playing with has a slightly different detail view.

By default now the relationships dropdown (and possibly later tab), is now broken up further between the Incoming and Outgoing connection lists. The parent tabs are now starting to remember settings too, so should you only be interested in say the generator detail you can set the relationships tab to be contracted in one entity and it will be remembered throughout all the others!

Detail View - A powerful change

2010-02-22T11:28:00.007+02:00

Yet another one of the huge changes made in 3 is the detail view, its now super useful in terms of being used during analysis. Previously selecting multiple entities merely showed you a list of these entities:

Now however it offers a much wider view, allowing you to sort by name, weight, incoming and outgoing links, as well being able to search/select these entities and have them selected on the graph, as seen below:

One of the other nice features is being able to go back to the graph by double clicking on one of the entities, this will then zoom that specific entity to the center of the graph.

The detail view is also extended for single entities and broken up into 3 different sections:

Relationships - showing your incoming and outgoing connections (also selectable, will change to that specific entity and center it on the graph)
Notes - The ability to make notes on an entity (not yet implemented)
Generator detail - the standard detail view showing snippets, transforms run to get to this entity etc.

You can see this below:

Each section is also collapsible and may at some stage change to a tabbed structure.

Its definitely a huge improvement and one I think will be greatly beneficial to analysts!

On a separate note, really enjoying Chuck Ragan today :)

New Icons

2010-02-22T11:00:00.002+02:00

So i wasn't completely happy with the old icons, they smaller sizes seemed to be slightly blurry and we have discussed it and picked a bunch of new ones, which still might change again depending on how well they come out within the app, see some of the choices below :)

List view and so on...

2010-02-19T07:52:00.004+02:00

Can't move. Played tennis last night (first time in a while)..and currently pulling the 17 Feb release. It's pushing 18MB. Wish we had more bandwidth. OK it's here - let's see....

Tested new client with some home grown transforms on a local TAS - discovery etc. works well. Lots of changes in List View (a new view we introduced in v3) - it's now almost working like it should.
The new icons still look uncool. Can do with it what we want, they still look crap. We might even go back to the old ones - or perhaps a mix of the two.

Context menus when running transforms now includes 'config transform', 'timing options' and 'help' buttons. I am hoping it's not overwhelming for users. We should still get them to do things.. The CPU problem turned out to be a memory problem. Increasing the memory available helps, but it simply delays the problem - thus...something is leaking. At least we can test further down the release.

Love to beta with this release, but we simply can't - at the very least we need to sort the CPU/memory problem before it goes out.

Custom Entities!

2010-02-18T18:34:00.007+02:00

Chris and the gang have been doing a fantastic job, heres just one of the many new features that i love, custom entity creation, no longer will it be a hack to get in your own entities.

Its a very simple wizard with a lot of advanced options (such as adding additional fields and regular expressions to match pasting), the new entity manager is also a blessing! See the pics below as i quickly (2 mins) create a new WifiAP for my graph.

The new Entity Manager

Setting properties and icons

Default values and sections

Adding it to a category

Specifying additional properties
In this case, ESSID, encryption and last seen dates. Note you can also specify the type and there are loads to choose from!

Display Settings

Plurals, Palette and Regular expressions

Using my new entity!

As you can see it is a relatively painless process and the final 3 steps (additional properties, display and regular expression screens) are optional. This is definitely going to make the local transform 'scene' explode as it allows for far more detailed customisation then we have ever had before!

-AM

Body surfing the notebook's PSU

2010-02-16T19:47:00.002+02:00

Hmmmm...warm and fuzzy!

Maltego Within Kubuntu 9.10

2010-02-16T18:04:00.003+02:00

Hey guys,

Finished building the .deb and .rpm files for 3, here is a screenshot of Maltego 3 - valentines release under kubuntu :)

Valentine's release

2010-02-16T17:37:00.003+02:00

Looking goooood. Icons are better because of the 48x48 size, labels are aligned. Feels like a monster - in a good way. Navigation is super quick and selection is very useful (with the new improved detailed view). There are still a lot of things that we need, but at this pace we'll have a winner real soon. I am smiling again.

:)

Installs - deb, rpm

2010-02-15T15:55:00.002+02:00

Andrew is making Debian and RPM installs. Saw what Maltego v3 looks like on Linux today. It looks...the same as on Windows. New release tomorrow morning - will do a write up in the pm. Installing Netbeans for the TAS development on my Windows machine - ready up for v3 server side.

New icons - bleh

2010-02-13T10:04:00.003+02:00

The new icons look really horrible in the graph. This is a real pity. We either need to choose new ones, or work on the sizing...or..something. It's amazing that things look really good on paper, but as soon as you work with it, it falls apart. Guess that's the difference between talking and thinking about things and making it really work in real life.

CPU is still flat lining as soon as you push the interface a bit - not that this is a surprise - the team spent a good deal of time working on branding and graphics this week. Makes the shitty icons even more of a setback. Detail view is back in, but it's not keep state of open and closed sections. Screen real estate is a real problem. Still missing a lot of short cut keys, copy and paste functionality..the list goes on. Are we ever going to get there..? We can only keep on trying and not lose hope that this is going to be great - someday.

:|

Maltego Wallpaper

2010-02-11T19:00:00.001+02:00

Not really a Maltego app related post, but i did make a nice clean wallpaper for Maltego today, and i am very glad that we moved past 4-bit music (see mods below).

Background - v4

2010-02-11T17:21:00.003+02:00

Thinking we're going with this. Art work is almost done.

Chasing CPU flatlining, detailed view. Sent entity definitions that had to be remapped to Chris so that he can get it into the v2 compatibility machine.

Should put the new icons in this week. Gone with IconShock's 'Golden' series. Should look very nice.

Listening to MODs - I am 15 again..

Horror movie it is...

2010-02-10T17:49:00.005+02:00

Manual linking lives!

2010-02-10T16:05:00.003+02:00

I just thought i'd give you guys a taste of manual linking as i created the word awe(some) with a couple of domain entities.

On par with dry land not being a myth in the cult classic Waterworld (http://www.imdb.com/title/tt0114898/) , manual linking is not a myth!

Intro screens (10/02)

2010-02-10T15:49:00.005+02:00

Finally my windows box is up and running and i can start playing as well!

One of the cool new things implemented in 3 are the new introduction screens which are going to make a nice refreshing change for anyone that is tired of loading transforms and sets and having to customise them everytime we make changes.

Sets, seeds and transforms will now be pulled from the three introduction screens. Plus this means less headaches for those people that previously had issues with certain linux distro's having no transforms!

9 Feb 21h00

2010-02-09T21:07:00.006+02:00

FTP-ing it from Chris at the moment, we're up to 17MB it seems. Background is in - it looks OK, but not stunning. The graphics looks a bit nicer in the wizard left hand pane, but I am still not convinced.

Edge weighted view is back in, with a new algorithm that's mapping the size of the node logarithmically and not linear to the number of incoming links. Should take out super huge nodes, and give a better indication. Perhaps we need to change to log 6 or 7 and not log 10. We'll see. At least with version 3 you can interact with the nodes in this view - e.g. run transforms etc. We still need to fit the labels in there. Satellite / overview window is back - thank goodness, sporting new colors. Pretty neat.

Transform pop-ups are proving to be very useful, but they should still keep state - e.g. remember the settings. CPU flatline is REALLY biting - seems that the more transforms you run at a time, the more the problem manifests itself. This is going to be a bitch to find and debug...I just know it.

Finally list view looks OK, think we'll need to add the ability to filter not just on value, but also on type. We're getting there - slowly...More tomorrow - this day is done!

Visitor

2010-02-09T16:09:00.003+02:00

Showed up here about 20 minutes ago. Took control of a chair within seconds.
'LolKat' :)

Beta testers

2010-02-09T13:15:00.002+02:00

A lot of people have been asking to be beta testers. For now, we are a little hesitant to let people play. The main reason for this is that 3.0 is not ready for beta testing. In other words - we know about a lot of things that needs be sorted out, and don't want to waste your time by putting something half baked out there. When we reach the point where we've chased down the obvious bugs and implemented the obviously missing features we'll open it up for beta testers. Promise!

Notes on weekend (06/02) release

2010-02-08T16:42:00.003+02:00

The biggest concern now is that the GUI sometimes hang and the CPU spikes to 100% and just sits there. Also, the threading needs to be sorted - this is due to the fact that we are using v2 server and a v3 client. While the v3 protocol still needs to be implemented we needed something to work with so at the moment we are translating 2 calls to something that works in 3.

The labels are still kind of jumbled up - spacing between icons haven't been implemented. We haven't added the new icon library or the new background and branding. Oh - and we'll have to redo all of that for CE.

Many of the 2 features are still not in - edge weighted view, clear all graph etc etc. And we missing key bindings. But it's getting to the point where it can be used for casual Maltego-ing.

The feeling today is strong - there is light at the end of the tunnel - the new dynamic layout is super sexy, the layout pause concept works really nice and the overall responsiveness is great. Let's hope it stays like that as we go along - we're really pushing to get it out. Soon, soon..

From the 'art department'

2010-02-08T16:40:00.000+02:00

Got this - not sure that's what we'll go with - but it's a start. To be used in splash screen and About.

Oh .. and of course - they didn't get the memo that this is for 3.0 and not 2.02.

Will keep you updated on the progress.

Why did we do this?

2010-02-08T16:37:00.003+02:00

We started with pre betas of Maltego version 3.0 last week. Internal for now as there are many things that are still breaking horribly. The idea would be to have a totally informal blog that is updated as we play with new releases. This will allow you to see how we progress...and will hopefully be interesting.