Backdoor with Password 123456 and Hardcoded Keys: How AI Cracked 'Encrypted' USB Drives
An AI-powered reverse engineering effort has exposed serious cryptographic flaws in several commercial USB encryption and copy-protection products, revealing backdoors and hardcoded keys that rendered user passwords meaningless.
The first target was the YutianDun drive from SecZure. The device hid encrypted files from Windows Explorer and opened them only in its own viewers. Analysis revealed two hidden accounts: Buffer with the fixed password 123456 and System with the password SECZURE.COM. Both accounts decrypted the same content identifier used to derive the AES file key, allowing full access without the administrator password.
The cryptographic scheme itself used fast MD5 and HMAC-MD5 operations without any slow key-derivation function, and the resulting AES key contained at most 64 bits of entropy. The presence of the backdoor accounts meant the main encryption could be bypassed entirely.
The second product examined was NetacFileLock. A single prompt to the AI agent led it to discover that the application initialized AES-256 with a hardcoded 32-byte key stored inside the executable. The user password was verified separately and never influenced the encryption key. Additional issues found included passwords written to diagnostic logs, independent 16-byte blocks encrypted in ECB mode without an IV, and MD5 used for both password verification and file signatures. The AI also explained why only one-third of large files were encrypted: the selective mode applied only to files larger than 1024 bytes with specific extensions.
The third product, KakaSoft USB Copy Protection 5.6.0.299, offered three protection levels. The two weaker modes used either no encryption or a trivial single-byte XOR. The strongest mode used Blowfish-CBC, yet the key derivation relied on a non-standard MD5 variant with altered shift constants and a fixed internal password obtained from an embedded seed file. This allowed the AI to recover the exact internal password and decrypt protected files without any user-supplied password.
The final target was Nexcopy Copy Secure. Its viewer application decrypted a configuration file using a hardcoded 32-byte certificate. The recovered configuration contained the actual 24-byte Triple DES key and 8-byte IV used to protect user files. The user password served only for viewer authentication and had no role in content decryption.
In each case the AI agent completed the core analysis in minutes using static analysis and targeted emulation, dramatically accelerating work that previously required extensive manual debugging with time-travel tracing.
Related articles
CVE-2026-98432: Temporary nftables Filter with Auto-Rollback for Ubuntu Servers
Administrators are deploying a temporary nftables-based mitigation for CVE-2026-98432 on Linux systems while awaiting official kernel patches. The filter drops IPv4 TCP packets with IP header length exceeding five, reducing exposure to the vulnerability. The procedure includes verifying kernel status via Canonical, preparing rollback commands, and using systemd timers to automatically remove the table after five minutes if connectivity is lost. Steps cover syntax validation with nft --check, integration with existing firewall configurations, and post-reboot verification to ensure the temporary table persists without interfering with ufw or Docker rules. Red Hat guidance on discarding packets containing IP options is referenced as a complementary measure. The process is designed for single-server testing before scaling to production fleets, with explicit instructions to avoid flush ruleset operations that could disrupt other tables.
Old iPhones Remain Vulnerable to Bootloader Exploits Despite Airplane Mode for Crypto Seed Storage
Founder of OneKey Ishi Wang has warned that resetting an old iPhone, enabling airplane mode, and storing a cryptocurrency wallet recovery phrase on the device does not provide reliable protection. Hardware vulnerabilities such as checkm8 affecting iPhone 4S through iPhone X and usbliter8 targeting A12 and A13 chips allow attackers with physical access to bypass the secure boot chain and execute code before iOS loads. These issues persist because the bootloader code cannot be overwritten through standard resets or iOS updates. While device passcode, Secure Enclave, and application-level encryption still serve as barriers, the risk level depends on the specific model, iOS version, and password strength. Wang advises against relying on disconnected older iPhones as cold storage solutions for seed phrases.
Docker Bypasses UFW Firewall Exposing PostgreSQL and Redis Ports to Rapid Malware Infections
A common Docker Compose setup with exposed database ports on fresh VPS instances allows attackers to compromise systems within minutes despite active UFW rules. Docker's use of DNAT rules in the PREROUTING chain and insertion of DOCKER-FORWARD chains before UFW rules in the FORWARD table routes external traffic directly to containers on internal bridge networks. IPv6 support in Docker versions 27 and later creates additional exposure vectors when administrators focus only on IPv4 protections or disable IPv6 filtering. Bots scan cloud IP ranges for open ports including 5432 and 6379, deploying miners such as kdevtmpfsi and kinsing or using Redis replication to load malicious modules. Historical cases include a Qdrant test instance on Hetzner compromised in under two minutes and similar issues reported in Spree Commerce starter templates. The article details Netfilter mechanics, protected-mode limitations in Redis, and specific exploitation techniques like CONFIG SET for cron jobs and CVE-2022-0543 Lua sandbox escapes.
WordPress 7.1.4 Addresses RCE in Update Process and Multiple Stored XSS Vulnerabilities
The WordPress development team released version 7.1.4 on October 28, 2026, as a security update to resolve several vulnerabilities. The most severe issue allows remote code execution during the software upgrade process. Multiple stored cross-site scripting flaws were also fixed, including those triggered by specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the advisory. Site administrators are strongly urged to apply the update immediately to prevent potential exploitation. The announcement was reported by Security NEXT on November 2, 2026.