John McAfee's Explanation of iOS Hack

Question

I'm referring to this YouTube video, and further comment from John:

I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, including its secure enclave with separate coprocessor that stores the encrypted fingerprint, the ephemeral key generated by the co-processor that even Apple doesn't know, the secure enclave memory isolated from the rest of the processes on the chip, etc. Doesn't matter. The main ARM processor has its own memory and that's what I'm interested in. I will simply sidestep calling the secure enclave and pretend it doesn't exist. I'm not trying to get encrypted data, merely trying to force a complete boot of IOS. Trivial, given the fact that the entire A7 system chip has been expanded into a board with separate components for every subfunction of the chip. on the board, the secure enclave processor and it's memory are fully accessible, even though we won't need it. made in China.

What I don't understand is how this solves the problem. In a nutshell, John is taking the hardware, extracting the assembly into a readable instruction set and running the code flow. He claims that finding the method that accepts the keyboard input and then finding the memory location of the Touch ID code will open the phone. What is is conveyed to the public, at least from a Joe Blogs standpoint, is the Touch ID code is stored in the clear i.e. You can just read it off with no post processing once you know the memory address.

Two things struck me:

1. I assume the TouchID Lock code, which is what he is referring to, is at the very least hashed and likely salted. I'm lead to believe it actually resides on a separate chip entirely with the encrypted finger print. So even having the memory location and the hash itself is pointless, you still need to brute force it and depending on complexity you are no further along.
2. He claims he needs an iOS full boot, which occurs regardless of if you have the TouchID Lock code or not, but critically you need to enter the TouchID code when the phone is booted anyway to do anything. So I don't see his point.

Unless I'm missing something, I don't see how this solves the problem and I feel its utterly misleading. Explanations & clarification welcome!

Answer 1

I think the biggest red flag to me is that he talks about the secure enclave. That model didn't even have one. I think that's enough to tell me he doesn't know what he's talking about.

The recovered iPhone is a model 5C. The iPhone 5C lacks TouchID and, therefore, lacks a Secure Enclave. The Secure Enclave is not a concern. Nearly all of the passcode protections are implemented in software by the iOS operating system and are replaceable by a single firmware update.

Source

If I could guess what he was getting to, it would be that he's on about getting an unofficial patched/modified iOS to boot to the lock screen and then allow it to allow numerous unlock attempts without wiping which is what was requested but limited by the iOS signing protection, when he's talking about just getting it to boot and fingerprints he is perhaps talking about bypassing the iOS signing protection that means the device will only boot official iOS code that it likes and matches the trusted fingerprint. From there the cracking can begin.

The fact he references a secure enclave that doesn't exist however to me makes me dubious of his further statements.

The best write-up I have found for this is at http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ most other sites appear to be getting this horrificly wrong.