Modified DES with linear S-boxes: the whole cipher becomes linear, thus easily breakable. See [original writeup](https://abiondo.me/2018/12/23/xmas18-white-rabbit/).