I’m happy to announce Sirius Planner, a task planner app that I’ve been working on in recent weeks. I’ve just released an alpha demo to a small number of people. Check out the features in the video below:
Sirius Planner is a calendar-based task planner that lets you:
Create and manage tasks
Prioritise tasks on a particular day via drag & drop
Move tasks to different days via drag & drop
Focus on tasks in a day, week, or 5-week period
This project is still in its early stages, but already has most of the core features in place. If this is something you think could be useful to you, please get in touch.
I’ve been doing some work with security on AWS recently, and part of that involved running security assessments using Amazon Inspector to identify vulnerabilities at network and host level.
If I launch a fresh EC2 instance right now using the Microsoft Windows Server 2019 Base AMI and run a host-level assessment, the report lists a vulnerability related to the PowerShellGet module:
Microsoft Security Response Center’s entry about this vulnerability explains a little more about it:
“A security feature bypass vulnerability exists in the PowerShellGet V2 module. An attacker who successfully exploited this vulnerability could bypass WDAC (Windows Defender Application Control) policy and execute arbitrary code on a policy locked-down machine.
“An attacker must have administrator privileges to create a configuration that includes installing PowerShellGet V2 module onto a machine from the PowerShell Gallery. The WDAC policy must be configured to allow the module to run. After this is done, PowerShell script can be injected and run fully trusted, allowing the attacker arbitrary code execution on the machine.”
— CVE-2020-16886 at MSRC
The same page says that this vulnerability was fixed in PowerShellGet v. 2.2.5. So why do we have this problem? Here’s why:
That AMI came with PowerShellGet 18.104.22.168, but we need version 2.2.5. We can install it by running a Powershell session in Administrator mode, and running the following commands (from the Installing PowershellGet documentation) and agreeing to install the NuGet provider:
This results in the new 2.2.5 version being installed alongside the older 22.214.171.124 one:
I don’t know enough to be able to say whether having that version 126.96.36.199 around still poses any kind of risk, but it seems to be enough for Amazon Inspector which no longer reports any vulnerability after installing version 2.2.5:
If you’re really paranoid, check out this Stack Overflow question for ways to get rid of the old version manually. I haven’t actually tried this, so be careful.
"You don't learn to walk by following rules. You learn by doing, and by falling over." — Richard Branson