Xusheng Li published four teardowns on 22 October, through Binary Ninja's write-up, of products that promise encryption or copy protection on USB drives. The tool doing the analysis was OpenAI Codex, driven through Binary Ninja's model interface.

Four products, and the clock

NetacFileLock came first. A prompt asking whether the cryptosystem was secure led Codex to a fixed 32-byte AES-256 key embedded in the executable, which decrypts files without the user's password. The article reports that reproducing a previously identified flaw took 7 minutes.

KakaSoft USB Copy Protection took about 9 minutes to unpack and analyse, then another 26 minutes and 6 short prompts to recover data from the supplied drive. Nexcopy Copy Secure took around 10 minutes and 5 prompts to trace an embedded value to the encrypted configuration holding the content key and initialisation vector.

SecZure's YutianDun produced the most uncomfortable finding: hidden Buffer and System accounts with fixed passwords, which recovered the file encryption key on two tested drives without the administrator password.

The failures are not cryptographic

Nothing here is an attack on AES. Li's own framing is that the findings reflect "poor key management and flawed authentication designs, not mathematical attacks on encryption algorithms".

The specifics are a catalogue of the ordinary: fixed keys shipped inside binaries, plaintext passwords written to diagnostic logs, MD5 used for password verification, unkeyed MD5 as a file signature, ECB-style behaviour with no initialisation vector, partial encryption in a fast mode, and hex truncation that cut an AES key's effective entropy to 64 bits.

Li describes the YutianDun accounts as a "technical backdoor without implying malicious intent", which is the correct way to say it and also the thing a customer cannot distinguish from the other kind.

His warning to buyers is the sentence to keep: "password prompts and copying restrictions do not necessarily guarantee cryptographic confidentiality."

Published without telling the vendors

0 CVEs were assigned. 0 vendor responses are reported. Li published without conventional coordinated disclosure, and gave a reason: "recalling or updating deployed devices is challenging".

Reasonable people disagree about that, and this is the second full-disclosure drop in a week after the Tailscale findings. The argument for it is that a device already sold and sitting in a drawer will not be patched whatever the vendor is told. The argument against is that nothing improves for the owner either, who now has a published weakness and no fix.

What is different here is that the affected population cannot act on the information at all. There is no update path for most of these products. The useful audience is the next buyer.

What the tooling says

Codex did not discover a new class of flaw. It did binary analysis quickly and cheaply enough that 4 products could be examined in the time a single one used to take, across a combined 52 minutes of reported analysis for the three teardowns that carry timings.

That changes who can do this work. The same pattern ran through the PHP flaws Calif found with a frontier model and the Node Brotli bug reported by OpenAI Codex Security. The findings are not exotic. The throughput is.

For a product category built on nobody bothering to look inside the binary, that is the whole threat model dissolving.

What to do

  • If your organisation issues encrypted USB drives, ask the vendor where the key comes from and whether the password protects the key or only the software.
  • Treat "password protected" and "copy protected" on a drive as a usability claim, not a confidentiality one, unless the vendor can answer the question above.
  • For data that genuinely needs protecting on removable media, use full-disk encryption you control rather than vendor software on the stick.
  • If you own one of the four named products, assume the contents are readable by somebody with the drive.

What is not established

  • Whether the vendors dispute any of it. None has responded publicly.
  • Whether other products in the category share the same flaws. Li says explicitly that the work does not imply every encrypted USB product is vulnerable.
  • Whether any of this has been exploited against real data.
  • How much of the analysis was Codex and how much was the researcher's direction. The prompt counts are published; the judgement behind them is not.
  • Whether CVEs will be assigned later.

The original write-up was not retrieved for this piece, and the timings above come from the reporting of it.