OpenAI Codex Identifies Critical Flaws in USB Encryption Products
Researcher Xusheng Li leveraged OpenAI Codex to rapidly uncover significant security vulnerabilities, including hardcoded keys and hidden accounts, in four popular USB encryption products.
A recent investigation by researcher Xusheng Li has demonstrated the potent capability of AI in uncovering critical security flaws within commercial software. Utilizing OpenAI's Codex, Li was able to identify vulnerabilities in four distinct USB encryption products, including hardcoded keys and hidden administrative accounts that bypassed standard password protections. The findings, published on Binary Ninja's blog, highlight a concerning trend of weak secret management rather than fundamental weaknesses in encryption algorithms themselves.
Li's research focused on SecZure's YutianDun, NetacFileLock, KakaSoft USB Copy Protection, and Nexcopy Copy Secure. By combining AI-assisted code analysis with practical testing, he showcased how rapidly these tools could expose exploitable flaws. In one instance, Codex identified a critical vulnerability in SecZure's YutianDun within just seven minutes. This product, designed to protect files and prevent copying, was found to have built-in accounts, 'Buffer' and 'System,' which could unlock encrypted content without the administrator password by directly accessing the file encryption key identifier.
The analysis of NetacFileLock revealed an even more direct path to compromise. With a single prompt to Codex asking for an assessment of its encryption, the AI identified a hardcoded 32-byte AES-256 key directly within the executable in under seven minutes. This meant the user-provided password was effectively bypassed, as the encryption key was not derived from it. Further analysis also uncovered passwords within diagnostic logs and identified independent block encryption with ECB-style behavior, indicating multiple layers of potential weakness.
These findings echo previous security concerns where hardcoded secrets have led to significant vulnerabilities. Similar issues have been observed in smart bulb firmware exposing Wi-Fi credentials and in UxCryptor ransomware that embedded its AES keys directly into the malware. Such cases underscore the critical importance of secure secret management practices, proving that an "encryption" label alone does not guarantee robust security.
KakaSoft USB Copy Protection 5.6.0.299, even at its highest protection setting, proved vulnerable. Li discovered that its Blowfish key was generated from an embedded seed, independent of the user's password. AI assistance was crucial in tracing the custom hashing code and recovering this secret. The process of locating the hidden file and demonstrating passwordless decryption took approximately 26 minutes.
Nexcopy Copy Secure, utilizing Drive Wizard 1.0.81, also exhibited a critical flaw. A fixed secret embedded within its viewer application provided direct access to the content key and initialization vector for Triple-DES encryption. While password and device checks were in place for the viewer, they did not protect the underlying file encryption key. The analysis for this vulnerability took around ten minutes.
Li's research was conducted without conventional coordinated disclosure, meaning vendors were not given prior notice before the findings were published. While the report does not suggest that all USB drives are vulnerable, it serves as a stark warning to consumers and businesses. It emphasizes the need for evidence that passwords genuinely protect encryption keys, rather than merely controlling access to an application interface.
The rapid identification of these flaws by AI tools like OpenAI Codex signals a potential shift in the cybersecurity landscape, enabling researchers to find vulnerabilities at an unprecedented speed. This necessitates a proactive approach from vendors in implementing secure coding practices and robust secret management to protect their users from increasingly sophisticated threats.