Recent research utilizing AI technology has exposed significant security vulnerabilities in several USB protection products. Led by researcher Xusheng Li, the study revealed hardcoded encryption keys and hidden accounts that could decrypt files without needing the user’s password.
Exposing USB Security Vulnerabilities
The investigation utilized OpenAI Codex to identify weaknesses in just seven minutes, pointing out the inadequacies in how these products manage sensitive information. The research did not indicate a breakthrough in encryption algorithms but highlighted critical security lapses.
Li’s work was detailed in a blog post on Binary Ninja dated October 22, 2026. The AI-assisted analysis focused on products such as SecZure’s YutianDun, NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure, combining software examination with practical tests on secured files.
Technical Findings and Analysis
SecZure’s YutianDun was found to have hidden accounts capable of unlocking files without the owner’s password. These accounts used simple credentials, such as ‘123456’ and ‘SECZURE.COM’, making them easily exploitable. The encryption strategy relied on outdated MD5 key generation and contained limited AES key randomness.
NetacFileLock revealed a fixed 32-byte AES-256 key through a single Codex prompt, with the encryption key being independent of the user password. This discovery was coupled with findings of passwords in logs and flawed encryption behaviors.
Broader Implications and Future Outlook
The investigation underlines the recurring issue of hardcoded secrets, previously noted in other cybersecurity studies, such as vulnerabilities in smart bulbs and ransomware exploiting embedded keys. These incidents emphasize the insufficiency of mere encryption labels for ensuring security.
KakaSoft USB Copy Protection and Nexcopy Copy Secure were also found vulnerable. KakaSoft’s system could be compromised within 26 minutes due to its reliance on an internal password. Nexcopy’s encryption was breached in ten minutes, with the fixed secret in its viewer proving inadequate for robust protection.
Li’s publication did not follow traditional disclosure methods and does not suggest all USB drives are susceptible. However, it stresses the importance of evidence that passwords protect content keys effectively, not just access interfaces.
