7

I'm referring to this YouTube video, and further comment from John:

I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, including its secure enclave with separate coprocessor that stores the encrypted fingerprint, the ephemeral key generated by the co-processor that even Apple doesn't know, the secure enclave memory isolated from the rest of the processes on the chip, etc. Doesn't matter. The main ARM processor has its own memory and that's what I'm interested in. I will simply sidestep calling the secure enclave and pretend it doesn't exist. I'm not trying to get encrypted data, merely trying to force a complete boot of IOS. Trivial, given the fact that the entire A7 system chip has been expanded into a board with separate components for every subfunction of the chip. on the board, the secure enclave processor and it's memory are fully accessible, even though we won't need it. made in China.

What I don't understand is how this solves the problem. In a nutshell, John is taking the hardware, extracting the assembly into a readable instruction set and running the code flow. He claims that finding the method that accepts the keyboard input and then finding the memory location of the Touch ID code will open the phone. What is is conveyed to the public, at least from a Joe Blogs standpoint, is the Touch ID code is stored in the clear i.e. You can just read it off with no post processing once you know the memory address.

Two things struck me:

  1. I assume the TouchID Lock code, which is what he is referring to, is at the very least hashed and likely salted. I'm lead to believe it actually resides on a separate chip entirely with the encrypted finger print. So even having the memory location and the hash itself is pointless, you still need to brute force it and depending on complexity you are no further along.
  2. He claims he needs an iOS full boot, which occurs regardless of if you have the TouchID Lock code or not, but critically you need to enter the TouchID code when the phone is booted anyway to do anything. So I don't see his point.

Unless I'm missing something, I don't see how this solves the problem and I feel its utterly misleading. Explanations & clarification welcome!

  • 1
    I'm always a little weary whenever McAfee says something, he's done a lot of mind altering drugs in his time. – sethmlarson Mar 3 '16 at 13:00
  • Maybe he is thinking that after it boots you can copy the hard drive onto a super computer and have fun. – AstroDan Mar 3 '16 at 13:14
  • 2
    Excellent answer here: arstechnica.com/security/2016/03/… – Colin Mar 3 '16 at 13:33
  • 1
    Given that his first boast about cracking into it "mainly via social engineering" while the phone's owner is dead and relatives are not close to him at all, I have to assume everything John McAfee says is part of a ruse to flee the country. – Jeff Meden Mar 3 '16 at 13:47
  • 1
    Really i don´t expect McAffee to say anything else but gibberish, but as far as i understand it, he wants to do AstroDans solution (above). Which is something FBI tries not to do due to danger of damage to the data with extracting, and it is not a really effective way, pretty sure the password is hashed+salted and with current calculation power of smartphones it is going to be strong encryption and they probably have no idea how the hashing in iphone really works, so... He really is just trying to get the press onto himself, probably prepairing some kind of project nobody will care about... – Ladislav Louka Mar 5 '16 at 18:32
7

I think the biggest red flag to me is that he talks about the secure enclave. That model didn't even have one. I think that's enough to tell me he doesn't know what he's talking about.

The recovered iPhone is a model 5C. The iPhone 5C lacks TouchID and, therefore, lacks a Secure Enclave. The Secure Enclave is not a concern. Nearly all of the passcode protections are implemented in software by the iOS operating system and are replaceable by a single firmware update.

Source

If I could guess what he was getting to, it would be that he's on about getting an unofficial patched/modified iOS to boot to the lock screen and then allow it to allow numerous unlock attempts without wiping which is what was requested but limited by the iOS signing protection, when he's talking about just getting it to boot and fingerprints he is perhaps talking about bypassing the iOS signing protection that means the device will only boot official iOS code that it likes and matches the trusted fingerprint. From there the cracking can begin.

The fact he references a secure enclave that doesn't exist however to me makes me dubious of his further statements.

The best write-up I have found for this is at http://blog.trailofbits.com/2016/02/17/apple-can-comply-with-the-fbi-court-order/ most other sites appear to be getting this horrificly wrong.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.