While the big Android smartphone players like Samsung, Huawei, LG and others tend to dominate the headlines and the markets, occasionally, smaller companies or corporations from other markets will come out with crazy designs. Caterpillar, for example, has a lineup of rugged, steel bodied steel Android phones, and Phone Arena reports that Energizer is throwing their hat into the fray as well. At MWC, they showed off the “Energizer Power Max P18K Pop” smartphone that comes with an 18,000 mAh battery. Insane capacity aside, the phone features a 6.2 inch 2160 x 1080 display, 6GB of RAM, 128GB of storage, and a MediaTek Helio P70 SoC, a relatively clean instance of Android 9, and 5 cameras, putting it on par with other upper-middle range Android handsets.



18,000 mah – this is the amount of charge this beast of a phone can hold. To put this figure into perspective, this is 4.5 times the charge capacity of a Galaxy S10+ or a Galaxy Note 9. The device can sustain a 90-hour phone call and will last 50 days in stand-by. To drain it, you’d need to play video for 2 days straight. The phone also doubles as a power bank, while a full recharge requires around 9 hours if its bundled quick charger is used. But perhaps it is now time to address the elephant in the room: this phone is humongous, reminiscent of Thor’s hammer, and it barely fits in a normal pocket. It also weighs a ton and can literally be used for self defense as the frame is made of metal. We can imagine it being a great phone for long flights or trips in the wild, but we can’t picture ourselves with this as our primary handset. The blue color is pretty, though… We’re told that the phone is set to launch in September of this year.

Discussion

Source: [H]ardOCP – Energizer Smartphone has a 18,000 mAh Battery

Last week, researchers unveiled a 19 year old bug in an ancient ACE archive decompresser that, up until recently, shipped with modern builds of WinRAR. WinRAR’s own website suggests that the software has a userbase of over 500 million, and while the latest beta versions of the software have removed the vulnerable .dll file, Bleeping Computer reports that researchers have already discovered a campaign to exploit the millions of unpatched software instances in the wild. The 360 Threat Intelligence Center says the “Malspam” campaign distributes malicious archives though email, but Bleeping Computer’s own testing reveals that it only works if UAC is disabled, or if WinRAR is run as an administrator.



On the other hand, if UAC is disabled or WinRAR is run with administrator privileges it will install the malware to C:ProgramDataMicrosoftWindowsStart MenuProgramsStartupCMSTray.exe… Once launched, the malware will connect to http://138.204.171.108/ and download various files, including a Cobalt Strike Beacon DLL. Cobalt Strike Beacon is a penetration testing tool that is also used by criminals to gain remote access to a victim’s computer… As we expect to see more malware attempt to exploit this vulnerability, whether it be through malspam or other methods, it is important that you upgrade to the latest version of WinRAR. If you are unable to upgrade for some reason, then you can use 0Patch’s WinRAR micropatch to address this specific WinRAR bug. This micropatch will fix the vulnerability in all 32-bit and 64-bit versions of WinRAR versions using the UNACEV2.DLL since 2005.

Extracting the exploit to ProgramData presumably allows it to run as an administrator without any kind of UAC prompt, but Windows also has a startup folder at “%appdata%/microsoft/windows/start menu/programs/startup” that (to my knowledge) doesn’t require admin rights to access. In addition to running up-to-date version of WinRAR (or alternatives like 7zip), occasionally checking either of those startup directories for files that shouldn’t be there is probably a good idea.

Discussion

Source: [H]ardOCP – Malspam Exploits a WinRAR Security Hole