[cynwoody]

Why would a guy that makes a living off cyber security, tell how to jail break a secure device?

Because his days of living off cyber security are long past, or at least, his relevance to the organization that is the source of his income. He lacks clue.

Apple has been ordered to install on the iPhone in question a software update that will disable the phone's limits on password retries and password retry frequency. Apple, alone, is able to build such a software update, because, before accepting a software update, the phone checks that the update is cryptographically signed by Apple. Apple is refusing to (1) code the update and (2) sign it. Thus, the current court battle.

Even if Apple were to provide the demanded OS update, the FBI would still have to brute-force the password, a task which could be trivial or impossible, depending on whether Farook had a four or six-digit password or a much longer password, like idunno, say, Ribab10nca-Ammact3r.

There may be an alternative. It may be possible to read the device's memory using electron microscopy techniques and import it into a virtual machine. That would cut Apple out of the loop. But the difficulty of the brute-forcing step would remain.

Then there is the question of whether there is anything of value on the phone. Farook and his bitch physically destroyed their personal phones. The phone the FBI wants into was Farook's work phone. On the one hand, the fact he didn't destroy it indicates it's worthless. On the other hand, it stopped backing up to iCloud six weeks before the attack. Hmm. Why did it do that?

[DoughtyOne]

Thanks for the interesting comments. I agree with you take on these things.

[ifinnegan]

“It may be possible to read the device’s memory using electron microscopy techniques and import it into a virtual machine”

Explain this a bit more if you can.

[palmer]

There may be an alternative. It may be possible to read the device's memory using electron microscopy techniques and import it into a virtual machine. That would cut Apple out of the loop. But the difficulty of the brute-forcing step would remain.

Seems reasonable. First removed the flash and read the AES-encrypted content (easy). Second examine the SoC (probably destroying it in the process) and get the passcode hash. If you can get the hash (maybe hard) you can get the passcode (easy). Third, get the UID that is burned into the HW. You need that and the passcode hash to get the AES key. That might be hard or impossible. There are probably tricks to scanning for a hardware code, but those tricks will be part of an arms race to keep it trick-proof.