Myself along with the rest of the Tactical FLEX team will descend upon Vegas sometime around Thursday afternoon for DEF CON® 19.

TACTICAL FLEX, DEF CON EDITION SWAG

This year we put together a little custom / limited edition t-shirt and other bits of swag specifically for DEF CON and will be giving it away to those we meet and greet.

I WANT SOME!

If you would like something, follow @aanval or myself (@loyalmoses) on Twitter, find us or let us know where you’re at and if we cross paths we’ll give you some. That easy.

We’ll be updating twitter often as we move about, so this will be the most efficient manner of communicating with us.

Come meet with us, hang out, swap stories, trade biz cards and pick up some swag.

See you there,

Enjoy.

~moses

The net is buzzing with fierce and fiery comments about Apple and their recently released Final Cut Pro X.

However, for me it doesn’t really matter. I’ve played with previous releases of FCP and although there is no doubt that Apple released FCPX very and admittedly early, for the non-pro user (like myself), it is simply an amazing application.

I grabbed a copy of it along with Compressor and Motion to work on a few promotional / marketing videos for Aanval (http://www.aanval.com). The change in technology-realms helps to clear my mind and removes me from my daily grind of information security, development and book writing.

Surprisingly, I found I really enjoyed working with FCPX and have since grabbed a Blue Yeti, M-Audio FastTrack Pro and a couple of KRK Rokit studio monitor speakers to create my own tiny audio / video editing studio. I can now definitely understand the magnetic addiction that so many people have to audio / video editing. So much fun.

Ultimately after investing a little bit into my new hobby, I wanted to first throw together a short video preview of Aanval to cut my teeth and put some of my newly learned skills to test.

I did this in the form of a 1 minute, Aanval Preview (Rough Edit — I call it this, because it still needs quite a bit of work). It can be found at http://www.aanval.com/preview/ or on Youtube at http://www.youtube.com/watch?v=lY1uhlqR1BI.

Have a look and enjoy.

~moses

As we’ve been commenting on over the past several months, Aanval v6 is a major interation and one we are sure greatly improves information security efficiency and security event management.

Although now would seem an appropriate time to catch up on sleep, we have a lengthy list of enhancements and features planned for v6 and will continue to aggressively roll out new builds following our release early, release often methodology.

The interface for Aanval v6 was completely re-written in Flex 4, scrapping the entire previous Flex 3 interface. The backend remains MySQL / PHP, however dozens of updates and optimizations were made to improve performance and stability.

Aanval is quite a large project, comprised of several hundred thousand lines of code. A major portion of time for this release was spent working on the interface (Flex 4). If you follow me on Twitter, you’d have witnessed a bit of my frustrations with the latest releases of Flash Builder (the unstable, Eclipse based pile of junk). But I’ll save all of that joy and excitement for another post.

A couple of more notable features of Aanval v6, besides the new multi-tasking interface are the GeoLocation displays and the re-introduced event correlation system.

• GeoLocation with integrated Google Maps is now available in both real-time and search displays to provide a global, visual reference of event attack sources.
• The event correlation system has been re-introduced with an updated interface to group and rank events that may be related to one another.

For more information on Aanval v6, including upgrade details, new license purchasing, etc – see  aanval.com

A short list of a few of Aanval v6′s new features and enhancements:

• All new live GeoLocation (Google Maps)
• All new event displays
• All new event correlation
• All new event browser
• All new live even monitor
• All new frequent X displays
• All new report management
• All new action management
• All new signature management
• All new datastore management
• All new policy management
• All new snort management
• All new syslog filter management
• All new installation and update system
• All new multi-tasking interface
• All new inter-display interaction
• All new look and feel
• And much… much, more
• Dozens of bug fixes are included, too numerous to list

A selection of screenshots, a few of these may be early release or even beta.

Aanval Snort & Syslog Intrusion Detection and Correlation Console

Aanval is the industry’s leading web-based gui for snort and syslog intrusion detection and correlation. Government security and defense organizations from more than a half dozen countries, educational institutions from around the world, global financial organizations as well as space exploration and military weapons manufacturers rely upon Aanval as a part of their security infrastructure.

http://www.aanval.com/

Enjoy.

~moses

I’m pretty excited to see more of these types of Apps showing up on mobile devices. The information security sector although very technical by nature seems to have been left behind when it comes to usability and native integration.

Our industry needs and wants more access to this data and it seems the guys over at Tenable feel the same way we do.

The Nessus App along with the Aanval iPhone / iPad App makes mobile network security management that much easier with nessus and snort in your pocket.

If you are a Nessus user, go snag it.

http://itunes.apple.com/app/nessus/id390891776?mt=8

Description (from iTunes App Store)

The Nessus iPhone app, from Tenable Network Security Inc., enables you to log into your Nessus scanners and start, stop and pause vulnerability scans as well as analyze the results directly from your iPhone.

This mobility helps improving the efficiency of your Incident Response process by letting you quickly log into a Nessus scanner from your phone to search previous scan results or check the status of an on-going scan.

(Requires an access to version 4.2 of the Nessus server, or newer)

Enjoy.

~moses

Reuters
http://www.reuters.com/article/idUS95542+09-Aug-2010+PRN20100809

Forbes
http://www.forbes.com/feeds/prnewswire/2010/08/09/prnewswire201008090815PR_NEWS_USPR_____SF47279.html

TecTrends
http://www.tectrends.com/tectrends/news/urn:newsml:prnewswire.com:20100809:SF47279:1.html

TheStreet.com
http://www.thestreet.com/story/10830573/1/ids-vendor-tactical-flex-first-to-offer-iphone-app.html

Puget Sound Business Journal
http://seattle.bizjournals.com/seattle/prnewswire/press_releases/national/Washington/2010/08/09/SF47279

If you have questions or comments regarding Aanval, Tactical FLEX or anything related to the two — drop us an email or a call.

~moses

We are extremely excited to have published the very first App of this kind, as well as firmly step once again, ahead of Aanval competitors by providing our customers and users with native iPhone and iPad access to live Snort and Syslog intrusion detection events.

Aanval iPhone is available in the iTunes App Store and is compatible with the iPhone, iPod Touch and iPad.

iTunes > Aanval iPhone direct link

Aanval iPhone functions for both the free limited version of Aanval as well as commercially licensed versions. It does require the latest release of Aanval 5.5 to function properly, so ensure you are up to date.

We have an extremely long list of features and enhancements planned for Aanval iPhone and customers should expect rapid updates over the next several weeks.

If you are a current Aanval user or customer, grab this little App and enjoy live event data on the go.

If you are not yet using Aanval… then go download and install it. It is available as a free single sensor version, or a fully licensed and supported commercial version.

Additionally, we sincerely appreciate all beta testers who took the time and effort to participate in testing Aanval iPhone prior to release.

Thanks again and enjoy.

~moses

With the release of this App, Aanval will be the first intrusion detection console / system with an accompanying iPhone / mobile device application.

Aanval iPhone will currently function on the iPhone, iPod Touch and iPad, although a very advanced and highly specialized iPad version will be available later this year.

The App integrates into Aanval’s backend system and provides real-time access to snort and syslog intrusion and correlation data. This allows analysts and administrators to access intrusion data from the convenience of their mobile device.

Seriously… snort and syslog events right in your pocket. How cool is this?

Here are a few screenshots of the Aanval iPhone App

We are wrapping up a final round of beta requests and will be releasing a stable version shortly thereafter.

The initial version of the App will be quite basic, with the ability to very much only view live events and event details, however we have a full feature and product timeline already laid out for both the iPhone and iPad versions of Aanval.

Enjoy.

~moses

APPLE 17″ MACBOOK PRO 2.8 GHZ UNIBODY GLOSSY SCREEN NEW – $1200

Of course, the pleasant aroma of SUCKERS-CLICK-HERE was wafting all about, but I have to admit I have a second little addiction; telling these little punks exactly what I think of them, then reporting the behavior.

Why? well, besides it just really making me mad… I have friends, family and colleagues who’ve been burned for $1000′s of dollars. It’s no good all around.

Another reason, is that quite a few of these scams target westerners in a dual purpose fashion. Taking our money to use it against us; snag the cash, then ship it off to a little anti-American terrorist group that in my opinion needs a GPS guided gift with a Made in America stamp from a Predator drone at 35,000 feet.

Counting slowly… 10, 9, 8, 7, 6, 5, 4, 3, 2, 1… deep breath… much better; moving on.

I sent Marky-mark a little bait email to get him all excited about a potential sucker-transaction. He replied quite quickly with the following:

“Hello,

Still available. The price is correct and not negotiable.
I’m willing to pay for all shipping and insurance fees because I’m from London, UK. I have a small electronics wholesale company here and I sold a lot of products in United States, in collaboration with a partner there. We stopped our work and now I have available in my warehouse a large quantity of products in US version.
All products are BRAND NEW in box, with receipt and 2 years international warranty.
Just let me know your full name, shipping address and personal email address then I’ll arrange the shipment through UPS 2nd Day Air.

Thanks“

Marks a nice guy! Free 2nd day shipping from the UK! Ya know, you don’t often find great businessmen like this anymore… wait a minute. He wouldn’t be scamming me would he?!

WARNING

If you have read up to this point and really think this is a good deal and want a piece of it, please close your browser window, go outside and try and clear your head. You are not thinking clearly enough to be on the Internet right now.

This is my response to Mark; but I fear I won’t get a reply.

“Mark, mark, mark…

What a dirtbag.

Of course you are in the UK selling Apple computers to people on Craigslist in the Seattle area at less than 1/2 of retail pricing.

I own an information security company and have an Apple reseller account and get a measly 8% discount off of retail pricing in one of their highest reseller tiers. Apple machines are premium sellers today, so the one and only reason to be listing a new machine at this price is to try and hook poor suckers deeper than their caution and common sense normally allows.

My guess is, you would like payment in the form of a money transfer, maybe Western Union or just be happy to take my credit card information. Of course to make me feel comfortable you’ll give me a UPS tracking number to convince me that the product is shipping, when in fact a tracking number means nothing if the product is never picked up or dropped off at UPS for delivery.

UPS 2nd day / express would run you about $400 US to send it to me. So of course you offer this at no charge, cause you are just such a nice guy and this makes the deal so amazing.

In addition to these obvious signs of lame criminal behavior, you are using a random @gmail address which of course a quick google search shows no results, so its obvious that you don’t do legitimate business with it.

I’ve already notified the FTC as well as the high tech crimes department of our local police agency as well as the FBI’s high tech crimes division. Chances are, there is nothing that will come of this based on my reports, but you’ll eventually get nailed. You losers always do.

My recommendation for you is to realize the full extent of what you are really doing here, crawl back in your little hole, clean your act up and try and become a productive member of society. Whatever your reasons are, realize this is absolutely wrong.

Hope you get caught sooner than later.

Loyal.“

Okay, truthfully… I only filled out the FTC’s online fraud forms, but never contacted the local high-tech crimes departments… not like Marky cares either way, but it made me feel better to call on such big guns even though they really don’t care either. Seriously… am I the only one that cares?!

Of course, I do realize this does nothing, but it sure makes me feel better. Like a super-hero, patrolling the dark streets of the World-Wide-Web…

This is Mark Wayne’s Gmail address for anyone who thinks I am nuts and wants a sweet deal on a 17″ MacBook Pro, shipped freely from the UK: waynemark4545@gmail.com

And a note to those who do use @gmail, @hotmail, @msn, @live, @mac/me, @yahoo, etc addresses, IMHO there is absolutely nothing professional about any of these free or semi-free email services… even though a domain and hosting service takes almost as little effort to setup and maintain, it lends a little something-something to your Internet appearance.

UPDATE : It was removed from craigslist about 25 minutes after my email.

Oh well, back to browsing Craigslist.

Enjoy.

~moses

Snort is the worlds most popular signature based network intrusion detection and prevention engine available today.

Snort is an open source project managed by Sourcefire, Inc.

Details and the official Snort website are available at: http://www.snort.org/

Those who are not yet fully familiar with Snort may not know that in order to really take advantage of the engine, an interface or console is necessary for the viewing, reporting and / or managing of sensors and intrusion data.

Interfaces are a plenty and range from web-based solutions which are free, to dedicated desktop applications which can quite easily exceed $50,000 or more.

The popularity of Snort among small businesses has grown quite significantly over the past few years, however because of limited budgets and other fiscal restraints these markets are rather largely ignored by a good portion of Snort related product vendors.

Aanval

Aanval is a comprehensive intrusion detection and correlation console designed specifically for Snort and Syslog. Aanval 5 is the latest iteration of Aanval built upon 5 years of strong success along with a new and advanced graphical user interface.

When creating Aanval (http://www.aanval.com/) more than 5 years ago, we envisioned a console that allowed for storage and searching of huge data sets, advanced reporting and real time alerting — all designed specifically for the small to medium sized business budget.

Aanval 5 is the most powerful and feature rich version of Aanval to date and exceeds all of our original visions.

Cost

Today’s global fiscal situation makes cost effective Snort solutions even more relevant than ever before. Security budgets are tightening, alternative solutions are being sought after and all the while some of these organizations refuse to offer concessions or cost reductions to aid these small and medium sized organizations in finding solutions to protect their environments.

These freely available tools (those relating to Snort) in my biased opinion don’t offer the features, functionality or professional resources to be used effectively in a business environment. As inviting as this statement is for an argument, it’s the reason I believe organizations of all sizes continue to make Aanval a permanent part of their network security architecture.

Each week I find myself listening to foreign and domestic businesses frustrated with over-priced competing solutions that in their words are almost ridiculously out of touch with budget reality.

One particular challenge that we’ve had over the years is helping our potential customers understand that a price tag is just that, a price tag. Perceived value in the market place is critical, but puffed-up costs shouldn’t be aimed like a loaded cannon at investigating organizations as the “incentive” to purchase.

Details

Aanval’s licensing costs are extremely competitive, easy to understand and bring some balance back to the industry.

License purchase and pricing: https://www.aanval.com/purchase/

More information on Aanval 5

~moses

[code]"Will Windows 7 Be More Secure Than Snow Leopard?

It will because it has to be. With the launch of Windows 7, Macs will be targeted much more often, and Apple's policy of concealing the related exposures has the potential to result in a major news story.

But it's our job to protect users and make sure all of this wonderful stuff is working safely. With Windows 7, our job generally gets easier -- and the Mac guys will have to sweat, for once." -- Rob Enderie[/code]

This is such silly dribble. How he connects the release of Windows 7 to more targeted attacks on OS X is beyond me.

He must have some super-insight into the mind of evil h@X0rs and somehow calculates that hackers and researchers are going to pass on an awesome opportunity to find new / exciting vulnerabilities in the  (historically proven) weakest operating system ever created and just slide on over to a new release of OS X for grins.

My favorite quote is the “It will because it has to be.”  heh.

Click here for original article