YutianDun and NetacFileLock: YutianDun and NetacFileLock USB Security Analysis

Researcher Xusheng Li used time-travel debugging and AI-assisted analysis, including OpenAI's Codex, to find two hidden accounts named 'Buffer' and 'System' with fixed passwords in YutianDun USB drives sold by SecZure, unlocking files without the administrator password, according to Binary Ninja. Li also found that NetacFileLock uses a hardcoded AES-256 key, logs user passwords, and employs insecure ECB-style block encryption, while YutianDun's cryptosystem relies on MD5/HMAC-MD5 and limits AES key entropy to 64 bits. Li concluded that AI-assisted reverse engineering reduces analysis of such security-theater hardware to a ten-minute task.

Evidence at a glance Loading source evidence… What was done Researcher Xusheng Li utilized AI to identify backdoors in YutianDun USB drives and cryptographic failures in NetacFileLock, demonstrating that AI can rapidly automate the analysis of security-theater hardware. Researcher Xusheng Li investigated the security of YutianDun USB drives, sold by SecZure, and NetacFileLock encryption utilities. Using time-travel debugging TTD and AI-assisted analysis, Li identified that YutianDun contains two hidden accounts, 'Buffer' and 'System', which utilize fixed passwords to decrypt files independently of the administrator password. The author reports that these accounts provide a backdoor, as they can unlock content on tested drives without the user's credentials. Binary Ninja https://binary.ninja/2026/10/22/breaking-more-encrypted-usb-drives-with-ai.html documents that the cryptosystem relies on MD5/HMAC-MD5 and limits AES key entropy to 64 bits. Additionally, Li applied OpenAI's Codex to NetacFileLock, which identified that the software uses a hardcoded AES-256 key, rendering user passwords ineffective for encryption. The AI also discovered that NetacFileLock logs user passwords and employs insecure ECB-style block encryption. Li concludes that these findings demonstrate how AI-assisted reverse engineering can reduce the effort required to analyze security-theater hardware to a ten-minute task. The research highlights that opaque cryptographic products may contain hard-to-detect backdoors even when the primary cryptosystem appears functional.