Monday, October 2, 2017

Frequency counts for music types for Itunes and Windows Media Player

Powershell script to enumerate all music file types including Windows Media Player and Itunes Libraries

#get media file type counts
$musicdir= $env:USERPROFILE+"\Music"
$cntsfile= $env:USERPROFILE+"\Music\MusicFileExtsCnt.txt"
Get-Childitem $musicdir -Recurse |
     WHERE { -NOT $_.PSIsContainer } | 
        Group Extension -NoElement | 
            Sort Count -Desc  > $cntsfile

#get computers age as of last update
$OS = Get-WmiObject -Class Win32_OperatingSystem 
$InstalledDate = $OS.ConvertToDateTime($OS.InstallDate) 
$Span = [datetime]::Now - $InstalledDate
$age = New-Object DateTime -ArgumentList $Span.Ticks
Write "Computer's age is:  $($age.Year -1) Years $($age.Month -1) Months $($age.Day) days old" | Add-Content $cntsfile


How to Run 


Cut and paste script into a file named MediaTypeCnts.ps1 in Downloads folder.


powershell "c:\Users\%username%\Downloads\mediatypecnts.ps1"

Results

A frequency counts for music types containing both Itunes, Windows Media Player and VLC libraries.


 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
Count Name                     
----- ----                     
 2988 .itc2                    
 2500 .au                      
 1723 .mp3                     
  803 .m4a                     
  139 .wma                     
  122 .m4r                     
   93 .ipa                     
   52 .jpg                     
   49 .wav                     
   40 .m4v                     
   37 .wpl                     
   34 .mid                     
   30 .aup                     
   19 .itl                     
   14 .epub                    
   13 .mp4                     
   12 .tmp                     
   11 .pdf                     
    7 .m3u                     
    6 .psd                     
    6 .zip                     
    5 .txt                     
    3 .xml                     
    2 .sfv                     
    2 .jpeg                    
    2 .nfo                     
    2 .m3u8                    
    2 .pls                     
    2 .png                     
    2 .itdb                    
    1 .log                     
    1 .bat'                    
    1 .db                      
    1 .bat                     
    1 .hub                     
    1 .DS_Store                
    1 .rtf                     
    1 .plist                   
    1 .cue                     
    1 .bin                     
    1 .lnk            


Post Your Results
Post your results in comments below and I will publish them.

Friday, September 29, 2017

"Illusion Gap" Malware Attack Bypasses Windows Defender Scans on Shared Folders Server

A new malware dubbed "Illusion Gap" exploits a design choice in how Windows Defender scans files stored on an Shared Folders (SMB) Server before execution.

In many offices, this is your local area network (LAN) drive, a dated term. The modern term is called Network-attached storage (NAS).

For Illusion Gap to work, the attacker must convince a user to execute a file hosted on a malicious SMB server under his control. This is not as complex as it sounds, as a simple shortcut file is all that's needed.

How Illusion Gap works

The problems occur after the user double-clicks this malicious file. By default, Windows will request from the SMB server a copy of the file for the task of creating the process that executes the file, while Windows Defender will request a copy of the file in order to scan it.

SMB servers can distinguish between these two requests, and this is a problem because an attacker can configure their malicious SMB server to respond with two different files.

The attacker can send a malicious file to the Windows PE Loader, and a benign file to Windows Defender. After Windows Defender scans the clean file and gives the go-ahead, Windows PE Loader will execute the malicious file without Windows Defender realizing they're two different things.
















From https://www.cyberark.com/threat-research-blog/illusion-gap-antivirus-bypass-part-1/

Thursday, September 28, 2017

What is the average size of office and pdf documents?

Microsoft Enterprise Search conducted a survey in 2012 asking compiling statistics from 100 different data sources spread across tens of millions of searchable items, to answer this question. What is the average size of a typical office document.  I could not find a more recent analysis. 
Here are the results:
  • The average size of an office document is 321 kB.
  • Most web content is smaller than 200kB
  • PowerPoint and PDF consume the most space
  • Word documents are most frequent
Src: Microsoft Enterprise Search / SharePoint content, 100 different data sources spread across tens of millions of searchable items




























Here's some SAN disk sizing if you have some data to back-up. For example you know that:
  •  306 GB for  1 million documents 
  • 2.98 TB for 10 million documents
  • 5.96 TB for 20 million docs
  • 8.94 TB for 30 M docs
  • 14.9 TB for 50 M docs.


I have made request to both Bing and Google for an update. Can anyone can help?