Backdoor with Password 123456 and Hardcoded Keys: How AI Cracked 'Encrypted' USB Drives

An AI-powered reverse engineering effort has exposed serious cryptographic flaws in several commercial USB encryption and copy-protection products, revealing backdoors and hardcoded keys that rendered user passwords meaningless.

The first target was the YutianDun drive from SecZure. The device hid encrypted files from Windows Explorer and opened them only in its own viewers. Analysis revealed two hidden accounts: Buffer with the fixed password 123456 and System with the password SECZURE.COM. Both accounts decrypted the same content identifier used to derive the AES file key, allowing full access without the administrator password.

The cryptographic scheme itself used fast MD5 and HMAC-MD5 operations without any slow key-derivation function, and the resulting AES key contained at most 64 bits of entropy. The presence of the backdoor accounts meant the main encryption could be bypassed entirely.

The second product examined was NetacFileLock. A single prompt to the AI agent led it to discover that the application initialized AES-256 with a hardcoded 32-byte key stored inside the executable. The user password was verified separately and never influenced the encryption key. Additional issues found included passwords written to diagnostic logs, independent 16-byte blocks encrypted in ECB mode without an IV, and MD5 used for both password verification and file signatures. The AI also explained why only one-third of large files were encrypted: the selective mode applied only to files larger than 1024 bytes with specific extensions.

The third product, KakaSoft USB Copy Protection 5.6.0.299, offered three protection levels. The two weaker modes used either no encryption or a trivial single-byte XOR. The strongest mode used Blowfish-CBC, yet the key derivation relied on a non-standard MD5 variant with altered shift constants and a fixed internal password obtained from an embedded seed file. This allowed the AI to recover the exact internal password and decrypt protected files without any user-supplied password.

The final target was Nexcopy Copy Secure. Its viewer application decrypted a configuration file using a hardcoded 32-byte certificate. The recovered configuration contained the actual 24-byte Triple DES key and 8-byte IV used to protect user files. The user password served only for viewer authentication and had no role in content decryption.

In each case the AI agent completed the core analysis in minutes using static analysis and targeted emulation, dramatically accelerating work that previously required extensive manual debugging with time-travel tracing.