I’ve been using Paterva’s Maltego software quite a bit lately in my testing. This software is a fantastic tool, and provides a great way to obtain a great deal of information about an organization or individual. It comes in two flavors, a community edition which is free, and a commercial edition which is not. Because I am using this for my job, I have the commercial version of Maltego.
Like I said, Maltego is a fantastic tool, but there’s one thing that bugs me about it; A number of the most interesting transforms that come with the product use the Technorati search engine to provide information about an entity (for those that don’t know, Technorati is a search engine that pulls information from the blogosphere and various social networks).
The problem is that the Technorati search engine uses the Creative Commons license for its technology, and they chose to go with the one that disallows commercial use.
That’s fine, it’s their code, they can license it however they want. My problem isn’t so much with them, as with Paterva for choosing to use their stuff in the Maltego product. Because I am hired by clients to perform this discovery, I am unable to use these transforms in Maltego (at least, as far as my understanding of the licensing goes) and so I have them disabled.
“So what?” you may ask. Well, what this means is that attackers using the free version of Maltego can get potentially useful information about a given company which a tester hired by the company, using the paid version of Maltego, can’t legally provide. (I should mention here that I have tried looking into whether Technorati provides a way to license their technology for commercial use, and as far as I can tell, there is no way to do so.)
This strikes me as insane, and not a GoodThing(tm) at all.