Run, don’t walk, to replace your iPhone battery for $29

Apple Genius Bar employees assist customers at the company’s Fifth Avenue store in New York. (John Moore/Getty Images)

Rarely is tech advice this cut and dried: If you bought an iPhone in 2016 or earlier, make an appointment at a Genius Bar as soon as possible. Apple just started a program that can make old iPhones feel new again — for just $29.

An Apple store or repair shop will pop the hood of your iPhone 6, 6s, SE or 7 and swap out the battery. Like a jalopy after a Jiffy Lube, a three-year-old iPhone with a fresh battery will not only run longer, chances are it will also run faster.

Just hurry up and do it. When I showed up with an appointment at my closest Apple store on Jan. 3, there were so many others also trying to replace their batteries that I had to join a weeks-long waiting list. Your local shop might have more supply, but battling hordes for repair (rather than a sexy new phone) is an unusual experience at an Apple store.

What’s the big deal? Apple shaved $50 off its standard battery fee in an extraordinary — but limited-time — effort to get back in our good graces. It got caught in December slowing iPhones with worn-out batteries — a move, it says, that keeps the phones from unexpectedly shutting down. If you always suspected your old iPhone was getting slower, you were right.

A Chicago Apple store employee demonstrates an iPhone 6s. (Photo by John Gress/Getty Images)

But now there’s a fix. While most of us were in a holidaze last week, Apple published a mea culpa and promised to make replacing the battery on an iPhone less expensive through the end of 2018. It made the move, it said, “to address our customers’ concerns, to recognize their loyalty and to regain the trust of anyone who may have doubted Apple’s intentions.” On Dec. 30, Apple said it would begin honoring a $29 price immediately.

[Could Apple’s battery program encourage people to upgrade less often?]

This is going to cost Apple a lot more than just overtime at the Genius Bar. Once your phone get a fresh battery and the processor kicks back to 100 percent, there’s a chance you might not feel the need to upgrade your iPhone for a while. One analyst, Mark Moskowitz of Barclays, expects the battery offer could cause Apple to sell 16 million fewer new iPhones. (And you definitely shouldn’t buy a phone you don’t need; here’s my advice on whether you should upgrade to this year’s iPhone 8 and X.)

Still, inexpensive battery replacement is the right thing for Apple to do. A good reputation is its best selling point in an era where smartphone features are reaching parity. Battery life is most people’s No. 1 complaint about their phones, and maintenance is a long-overdue part to smartphone ownership. When Apple makes repairing phones as easy as buying new ones, it saves us money and it’s better for the environment.

How to replace an iPhone battery

An iPhone 6 battery from a teardown by gadget repair site iFixit. (Photo: iFixit)

How do you know if you’d benefit from a new battery? Apple has promised a software update soon that gives us more visibility into battery health. For now, though, if your phone is really bad off there might be a warning message when you dig into the settings menu. Or here’s a yardstick: If your iPhone can’t last from morning coffee to happy hour on a single charge, it’s time.

Anyone with an iPhone 6 or newer is eligible for the $29 replacement, regardless of what Apple’s battery tests report. (If you paid for AppleCare+ coverage, it might even be free.) Remember, this isn’t just about improving battery life; some tests have found replacing the battery can result in speed improvements of over 100 percent.

To get a new battery, log on to Apple’s support site, and then select iPhone, then Battery, then Battery replacement. If you live near an Apple store or authorized repair shop such as Best Buy, select one and make an appointment. (Call ahead to third-party shops to make sure they’ll honor the $29 offer.)

Then be prepared to wait. Most of my local stores are booked for days. And just because you have an appointment doesn’t mean you’ll get your replacement right away. I went in to Apple’s San Francisco flagship five days after its announcement and my store Genius reported he was already out of stock of iPhone 6 batteries — and there were thousands of other customers ahead of me to get one. They’ll email me when there’s a battery in stock, at which point I have to go back to the store.

Apple could improve this process. As my Genius explained it, you can’t get in the queue for a replacement battery until a Genius has signed off on your order — so there’s no way to avoid two trips. And there’s also no way to easily check stock supplies; when I tried calling another store, I couldn’t get a straight answer. If Apple can’t meet customer demand for replacements, it ought to at least help set our expectations.

There are a few other options. If you live far away from a store and have a backup phone handy, you could mail your iPhone to Apple to replace the battery, via the same Apple support site. (There’s also a $7 shipping fee.)

You could take the unofficial route. A service called iCracked will send a repair person to you to replace a battery for between $20 and $50. Some mom-and-pop repair shops will replace an iPhone battery for less than $30.

Or there is the hands-on approach: Buy a battery replacement kit, like the $25 one sold by iFixit. This isn’t for the clumsy or fainthearted, but there’s a special satisfaction to opening up a gadget and seeing what makes it tick … and then ripping it out and replacing it with something better.

Why the Singularity is Not a Singularity

Amazon could soon play ads to users shopping with Alexa, says report

Up here in the Great White North, the ability to make purchases on Amazon through Alexa is brand new, given that the Echo only just recently launched in Canada. In the U.S. though, this functionality has been around for a few years. With the Echo expanding to more regions, Amazon might have plans to place ads within its voice-activated Alexa speaker, according CNBC’s sources. Amazon has reportedly been in talks with Procter & Gamble and Clorox, in an effort to locate companies willing to pay to have their products placed higher in Alexa’s search results. Alexa might also soon advertise related products to users who previously bought specific items. This is similar to how the retail platform currently recommends products on the web. Sources report that Alexa could also suggest a specific brand’s products when a user asks for help performing a task, like cleaning up an accidental spill. It’s worth noting that Amazon’s current rules limit what types of ads can be delivered to users through Alexa. “Streaming music, streaming radio, podcast, and flash briefing skills may include audio advertisements as long as (1) the advertisements do not use Alexa’s voice or a similar voice, refer to Alexa, or imitate Alexa interactions and (2) the skill does not include more or materially different advertising than is included when the same or similar content is made available outside of Alexa,” reads an excerpt from a May 19th, 2017 Amazon Alexa blog post. Last year, a company called VoiceLabs made an effort to begin monetizing specific Alexa Skills, but the above policy shift forced it to stop selling sponsored messages. To Amazon’s credit, a spokesperson has denied CNBC‘s claims, stating that the company has no plans to bring advertisements to Alexa, according to a statement sent to Engadget. Given that voice-activated assistants like Google Assistant, Apple’s Siri and Samsung’s Bixby are viewed as the future of how consumers will interact with tech devices, ad placement potential is surely an exciting proposition for advertisers. From the perspective of someone who frequently utilizes devices like Alexa and Google Home to control smart home devices, I hope that when ads inevitably make their way to these devices, they’re not overly intrusive. I don’t look forward to the possibility of a Black Mirror-like dystopian future where asking Alexa to turn on my lights results in a 30-second Philips Hue smart lightbulb pre-roll.

Read more at MobileSyrup.com: Amazon could soon play ads to users shopping with Alexa, says report

python sweetness

The mysterious case of the Linux Page Table Isolation patches

[Various errors and updates are addressed in Quiet in the peanut gallery]

tl;dr: there is presently an embargoed security bug impacting apparently all contemporary CPU architectures that implement virtual memory, requiring hardware changes to fully resolve. Urgent development of a software mitigation is being done in the open and recently landed in the Linux kernel, and a similar mitigation began appearing in NT kernels in November. In the worst case the software fix causes huge slowdowns in typical workloads. There are hints the attack impacts common virtualization environments including Amazon EC2 and Google Compute Engine, and additional hints the exact attack may involve a new variant of Rowhammer.

I don’t really care much for security issues normally, but I adore a little intrigue, and it seems anyone who would normally write about these topics is either somehow very busy, or already knows the details and isn’t talking, which leaves me with a few hours on New Years’ Day to go digging for as much information about this mystery as I could piece together.

Beware this is very much a connecting-the-invisible-dots type affair, so it mostly represents guesswork until such times as the embargo is lifted. From everything I’ve seen, including the vendors involved, many fireworks and much drama is likely when that day arrives.

LWN

The trail begins with LWN’s current state of kernel page-table isolation article posted on December 20th. It’s apparent from the tone that a great deal of urgent work by the core kernel developers has been poured into the KAISER patch series first posted in October by a group of researchers from TU Graz in Austria.

The purpose of the series is conceptually simple: to prevent a variety of attacks by unmapping as much of the Linux kernel from the process page table while the process is running in user space, greatly hindering attempts to identify kernel virtual address ranges from unprivileged userspace code.

The group’s paper describing KAISER, KASLR is Dead: Long Live KASLR, makes specific reference in its abstract to removing all knowledge of kernel address space from the memory management hardware while user code is active on the CPU.

Of particular interest with this patch set is that it touches a core, wholly fundamental pillar of the kernel (and its interface to userspace), and that it is obviously being rushed through with the greatest priority. When reading about memory management changes in Linux, usually the first reference to a change happens long before the change is ever merged, and usually after numerous rounds of review, rejection and flame war spanning many seasons and moon phases.

The KAISER (now KPTI) series was merged in some time less than 3 months.

Recap: ASLR

On the surface, the patches appear designed to ensure Address Space Layout Randomization remains effective: this is a security feature of modern operating systems that attempts to introduce as many random bits as possible into the address ranges for commonly mapped objects.

For example, on invoking /usr/bin/python, the dynamic linker will arrange for the system C library, heap, thread stack and main executable to all receive randomly assigned address ranges:

$ bash -c ‘grep heap /proc/$$/maps’
019de000-01acb000 rw-p 00000000 00:00 0                                  [heap]
$ bash -c ‘grep heap /proc/$$/maps’
023ac000-02499000 rw-p 00000000 00:00 0                                  [heap]

Notice how the start and end offset for the bash process heap changes across runs.

The effect of this feature is that, should a buffer management bug lead to an attacker being able to overwrite some memory address pointing at program code, and that address should later be used in program control flow, such that the attacker can divert control flow to a buffer containing contents of their choosing, it becomes much more difficult for the attacker to populate the buffer with machine code that would lead to, for example, the system() C library function being invoked, as the address of that function varies across runs.

This is a simple example, ASLR is designed to protect many similar such scenarios, including preventing the attacker from learning the addresses of program data that may be useful for modifying control flow or implementing an attack.

KASLR is “simply” ASLR applied to the kernel itself: on each reboot of the system, address ranges belonging to the kernel are randomized such that an attacker who manages to divert control flow while running in kernel mode cannot guess addresses for functions and structures necessary for implementing their attack, such as locating the current process data, and flipping the active UID from an unprivileged user to root, etc.

Bad news: the software mitigation is expensive

The primary reason for the old Linux behaviour of mapping kernel memory in the same page tables as user memory is so that when the user’s code triggers a system call, fault, or an interrupt fires, it is not necessary to change the virtual memory layout of the running process.

Since it is unnecessary to change the virtual memory layout, it is further unnecessary to flush highly performance-sensitive CPU caches that are dependant on that layout, primarily the Translation Lookaside Buffer.

With the page table splitting patches merged, it becomes necessary for the kernel to flush these caches every time the kernel begins executing, and every time user code resumes executing. For some workloads, the effective total loss of the TLB lead around every system call leads to highly visible slowdowns: @grsecurity measured a simple case where Linux “du -s” suffered a 50% slowdown on a recent AMD CPU.

34C3

Over at this year’s CCC, you can find another of the TU Graz researchers describing a pure-Javascript ASLR attack that works by carefully timing the operation of the CPU memory management unit as it traverses the page tables that describe the layout of virtual memory. The effect is that through a combination of high precision timing and selective eviction of CPU cache lines, a Javascript program running in a web browser can recover the virtual address of a Javascript object, enabling subsequent attacks against browser memory management bugs.

So again, on the surface, we have a group authoring the KAISER patches also demonstrating a technique for unmasking ASLR’d addresses, and the technique, demonstrated using Javascript, is imminently re-deployable against an operating system kernel.

Recap: Virtual Memory

In the usual case, when some machine code attempts to load, store, or jump to a memory address, modern CPUs must first translate this virtual address to a physical address, by way of walking a series of OS-managed arrays (called page tables) that describe a mapping between virtual memory and physical RAM installed in the machine.

Virtual memory is possibly the single most important robustness feature in modern operating systems: it is what prevents, for example, a dying process from crashing the operating system, a web browser bug crashing your desktop environment, or one virtual machine running in Amazon EC2 from effecting changes to another virtual machine on the same host.

The attack works by exploiting the fact that the CPU maintains numerous caches, and by carefully manipulating the contents of these caches, it is possible to infer which addresses the memory management unit is accessing behind the scenes as it walks the various levels of page tables, since an uncached access will take longer (in real time) than a cached access. By detecting which elements of the page table are accessed, it is possible to recover the majority of the bits in the virtual address the MMU was busy resolving.

Evidence for motivation, but not panic

We have found motivation, but so far we have not seen anything to justify the sheer panic behind this work. ASLR in general is an imperfect mitigation and very much a last line of defence: there is barely a 6 month period where even a non-security minded person can read about some new method for unmasking ASLR’d pointers, and reality has been this way for as long as ASLR has existed.

Fixing ASLR alone is not sufficient to describe the high priority motivation behind the work.

Evidence: it’s a hardware security bug

From reading through the patch series, a number of things are obvious.

First of all, as @grsecurity points out, some comments in the code have been redacted, and additionally the main documentation file describing the work is presently missing entirely from the Linux source tree.

Examining the code, it is structured in the form of a runtime patch applied at boot only when the kernel detects the system is impacted, using exactly the same mechanism that, for example, applies mitigations for the infamous Pentium F00F bug:

More clues: Microsoft have also implemented page table splitting

From a little digging through the FreeBSD source tree, it seems that so far other free operating systems are not implementing page table splitting, however as noted by Alex Ioniscu on Twitter, the work already is not limited to Linux: public NT kernels from as early as November have begun to implement the same technique.

Guesswork: Rowhammer

Digging further into the work of the researchers at TU Graz, we find When rowhammer only knocks once, an announcement on December 4th of a new variant of the Rowhammer attack:

In this paper, we present novel Rowhammer attack and exploitation primitives, showing that even a combination of all defenses is ineffective. Our new attack technique, one-location hammering, breaks previous assumptions on requirements for triggering the Rowhammer bug

As a quick recap, Rowhammer is a class of problem fundamental to most (all?) kinds of commodity DRAMs, such as the memory in the average computer. Through precise manipulation of one area of memory, it is possible to cause degradation of storage in a related (but otherwise logically distinct) area of memory. The effect is that Rowhammer can be used to flip bits of memory that unprivileged user code should have no access to, such as bits describing how much access that code should have to the rest of the system.

I found this work on Rowhammer particularly interesting, not least for its release being in such close proximity to the page table splitting patches, but because Rowhammer attacks require a target: you must know the physical address of the memory you are attempting to mutate, and a first step to learning a physical address may be learning a virtual address, such as in the KASLR unmasking work.

Guesswork: it effects major cloud providers

On the kernel mailing list we can see, in addition to the names of subsystem maintainers, e-mail addresses belonging to employees of Intel, Amazon and Google. The presence of the two largest cloud providers is particularly interesting, as this provides us with a strong clue that the work may be motivated in large part by virtualization security.

Which leads to even more guessing: virtual machine RAM, and the virtual memory addresses used by those virtual machines are ultimately represented as large contiguous arrays on the host machine, arrays that, especially in the case of only 2 tenants on a host machine, are assigned by memory allocators in the Xen and Linux kernels that likely have very predictable behaviour.

Favourite guess: it is a privilege escalation attack against hypervisors

Putting it all together, I would not be surprised if we start 2018 with the release of the mother of all hypervisor privilege escalation bugs, or something similarly systematic as to drive so much urgency, and the presence of so many interesting names on the patch set’s CC list.

One final tidbit, while I’ve lost my place reading through the patches, there is some code that specifically marked either paravirtual or HVM Xen as unaffected.

Invest in popcorn, 2018 is going to be fun

It’s totally possible this guess is miles off reality, but one thing is for sure, it’s going to be an exciting few weeks when whatever this thing is published.

Discovery of Unknown Ancient Population Changes Our Understanding of How North America Was Settled

She died 11,500 years ago at the tender age of six weeks in what is now the interior of Alaska. Dubbed “Sunrise Girl-child” by the local indigenous people, the remains of the Ice Age infant—uncovered at an archaeological dig in 2013—contained traces of DNA, allowing scientists to perform a full genomic analysis. Incredibly, this baby girl belonged to a previously unknown population of ancient Native Americans—a discovery that’s changing what we know about the continent’s first people.

Recent Video from Gizmodo

VIEW MORE >

12/28/2017

Genetic evidence published today in Nature is the first to show that all Native Americans can trace their ancestry back to a single migration event that happened at the tail-end of the last Ice Age. The evidence—gleaned from the full genomic profile of the six-week-old girl and the partial genomic remains of another infant—suggests the continent’s first settlers arrived in a single migratory wave around 20,900 years ago. But this population then split into two groups—one group that would go on to become the ancestors of all Native North Americans, and another that would venture no further than Alaska—a previously unknown population of ancient North Americans now dubbed the “Ancient Beringians.”

It’s well established that North America’s first settlers migrated from Siberia into Alaska prior to the end of the last Ice Age via an ancient land bridge known as Beringia (actually, the term “bridge” is a bit of a misnomer as Beringia was a sizeable landmass measuring 620 miles (1,000 km) at its widest extent and encompassing an area as large as the Canadian provinces of British Columbia and Alberta combined; those humans living and venturing across this landmass would hardly think of it as a “bridge”). But scientists aren’t sure if there was a single founding group or several, or when the migration actually happened.

The remains of two human infants, found at the Upward Sun River (USR) site in the Alaskan interior, are changing what we know of this important period in human history. The researchers who conducted the genetic analysis, which involved teams from the University of Cambridge, the University of Copenhagen, and the University of Alaska Fairbanks, were fully expecting the USR DNA to match the genetic profiles of other northern Native American people—but it matched no other known ancient population, not even the two recognized branches of early indigenous peoples, known as Northern and Southern. It also didn’t match any contemporary human populations.

“We didn’t know this population existed,” said Ben Potter, professor of anthropology at the University of Alaska Fairbanks and a lead author of the new study, in a statement. “These data also provide the first direct evidence of the initial founding Native American population, which sheds new light on how these early populations were migrating and settling throughout North America.”

Genetic analysis showed that these Ancient Beringians were more closely related to early Native Americans than their Asian and Eurasian ancestors. Even though the DNA extracted from the second infant wasn’t able to produce a full genome for analysis, the researchers were able to determine that the two girls belonged to the same population. The genetic analysis, combined with computer-based population modeling, allowed the researchers to conclude that a single founding ancestral indigenous American group split from East Asians around 35,000 years ago. Then, around 20,000 years ago, this group split into two groups: the ancestors of all Native Americans, and the Ancient Beringians.

“The Ancient Beringians diversified from other Native Americans before any ancient or living Native American population sequenced to date. It’s basically a relict population of an ancestral group which was common to all Native Americans, so the sequenced genetic data gave us enormous potential in terms of answering questions relating to the early peopling of the Americas,” said lead author Eske Willerslev, who holds positions at both the University of Cambridge and the University of Copenhagen. “We were able to show that people probably entered Alaska before 20,000 years ago. It’s the first time that we have had direct genomic evidence that all Native Americans can be traced back to one source population, via a single, founding migration event.”

The discovery suggests two possible scenarios for the peopling of the Americas. Either two distinct groups of people crossed over Beringia prior to 15,700 years ago, or one group of people crossed over the land bridge and then split in Beringia into two groups, namely the Ancient Beringians and the Native Americans (where the latter moved south of the ice sheets 15,700 years ago). The study also reaffirms a pre-existing theory known as the “Standstill Model”—the possibility that the descendents of this single-source population were living in Beringia until about 11,500 years ago.

Regardless, it now appears that the Ancient Beringians stayed in the far North for thousands of years, while the ancestors of other Native American peoples spread throughout the rest of North America. The new genetic analysis, along with previous archaeological work, also lends credence to the idea that an offshoot of these migrants, known as the Athabascans, made their way back into the northern regions of North America again, possibly around 6,000 years ago (a process known as back migration), eventually absorbing or replacing the Ancient Beringians. More research will be required to bear this theory out.

“The differences between the genomes of the Upward Sun River infants and the genomes of other ancient Native Americans sets the Alaskan infants apart,” Gary Haynes, an anthropologist at the University of Nevada, told Gizmodo, “But there are also similarities which suggest that all the studied individuals are descendants of a single ancestral founding population. The USR population split after 20,900 years from the population that gave rise to all modern northern and southern Native Americans. The critical importance of this conclusion, if it is correct, is that it provides support for the view that a single founding population from Northeast Asia gave rise to all the native peoples of the Americas. This is a significant finding which establishes that all the pre-Columbian native peoples of the New World are members of one family tree.”

Haynes, who isn’t affiliated with the new study, says it’s important to keep in mind that the paper’s conclusions are based heavily on genetic analysis and that the authors weren’t able to provide empirical support in the form of archaeological evidence with firm dates.

“The suggested dating of population movements and genetic divergences in the paper relies on estimates of genetic rates of change, with tacit support from paleogeographic data (the existence of ice sheets at certain times, for example, blocking human movement), and the implication that archeological claims are correct about human presence [more than 15,000 years ago] in the Americas south of Beringia,” he said.

David Lambert, a professor at Griffith University’s Australian Research Centre for Human Evolution, says the study was “carefully conducted, and employed generally well understood laboratory… methods,” and that the research was of “a very high standard.” Lambert, who wasn’t involved in the new study, says the authors presented strong genomic evidence for a previously unknown but distinct early North American population.

“The conclusions are sound and it is clear that the results represent a significant new chapter in our understanding of the settlement of North America,” Lambert told Gizmodo. “The authors present evidence for a complex history of late Pleistocene genomic evolution that includes evidence for introversion [the spawning of new populations who keep to themselves], back migrations, and evidence of a single founding population that split from East Asians.”

Lambert is particularly stoked about the way ancient DNA is able to produce new and unexpected findings. “This study shows that even a single ancient genome sequenced to a good coverage can potentially make major contributions to our understanding of ancient complex histories,” he said.

Indeed, this study is dependent on a single—albeit really good—sample of DNA. It’s possible the infant could be some kind of a genetic outlier (an unlikely scenario given the similarities observed between the two USR infants). More genetic evidence of these Ancient Beringians, along with more archaeological evidence, will be required to affirm these findings and push this research forward. But it’s an exciting result nonetheless—one that paints more a more complex picture of how North America was settled.

[Nature]

RECOMMENDED STORIES

America’s first settlers were trapped in Beringia for 10,000 years

We Were Wrong About How Ancient Humans Colonized North America

Controversial Study Makes a Staggering Claim About When the First Humans Settled North America

ABOUT THE AUTHOR

George Dvorsky

George is a contributing editor at Gizmodo and io9.