Security researcher Xusheng Li revealed cryptographic flaws in four USB protection products, showcasing how OpenAI Codex accelerated reverse engineering and allowed recovery of protected files without user passwords. In a research report published October 22, 2026, Li detailed findings affecting SecZure’s YutianDun, NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure. The investigation exposed hardcoded secrets, hidden accounts, weak key derivation, and authentication checks disconnected from encryption.
Although the administrator’s password protected one copy of that identifier, two built-in accounts provided alternative access. The hidden Buffer account used the default password "123456," while System utilized the fixed password "SECZURE.COM." On two tested drives, both accounts unlocked the identifier needed to decrypt protected files.
Using Binary Ninja's Model Context Protocol integration, Codex replicated Li's earlier NetacFileLock findings via static analysis in just seven minutes.
Additional findings included passwords written to diagnostic logs, MD5-based verification, an unkeyed MD5 file signature, and another fixed key for SM4 encryption. High mode XORed the first 16,385 bytes using a byte-sized key, leaving only 256 possibilities and the remaining content exposed. Li published his findings directly without following conventional coordinated disclosure, citing difficulties in recalling or updating deployed devices.
Collectively, the demonstrations illustrate how inspectable client software can circumvent password prompts and copying restrictions when recoverable secrets ultimately determine file decryption. Explore for your team.
