Security researcher Xusheng Li has found that Lenovo's ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device, contained no actual encryption, the fingerprint reader only enabled the USB connection, and the internal SD card's data was unprotected. An AI-assisted follow-up then discovered backdoor accounts and hardcoded cryptographic keys in other supposedly secure USB storage products from multiple vendors.
The FU100 is "just an SD card in a fancy case," Li said in a March conference talk reported by HackingPassion. He said that "'hardware security' can be pure marketing" and that anyone with physical access could trivially read the drive's data.
Lenovo issued fixes earlier this year for the FU100, FU200, TU800 drives and the TSD303 SSD. The company rated the advisory's severity as high and assigned three CVEs. One of these covers the configuration software, which could let a locally logged-in user bypass device authentication and enroll an untrusted fingerprint. Owners must call a China service line to either send devices back for replacement or receive an on-site firmware upgrade. Lenovo advises backing up data first and recommends wiping the drive before sending it in.
The same research also found a different flaw in Lenovo's TSD303 external SSD. Its data was encrypted, but the device sent the correct password back over USB in plain text for comparison, making it easy to capture. Lenovo's initial fix used block cipher encryption with a key derived from a timestamp-like value, which its software could also derive. The first software fix was vulnerable if taken apart, making it not useful for protecting data if the device was stolen. A later fix has the drive check the typed password itself, so the correct password never leaves the drive.
Li used OpenAI's Codex AI tool with his employer's reverse-engineering tool to examine other vendors' protection schemes. Netac's tool took about seven minutes to break, as Codex found a fixed key built into the program and the user's password written to diagnostic logs. Netac had no patch as of Li's March talk.
KakaSoft's USB Copy Protection software built an internal password itself, which Codex rebuilt to decrypt a test file without the user's password in about 26 minutes. Nexcopy's Copy Secure took about 10 minutes, with its key unlocked by a certificate built into the viewer app. Separately, SecZure's YutianDun had two hidden "backdoor" accounts with simple passwords, discovered using time-travel debugging.
Li gave no warning to KakaSoft, Nexcopy, or SecZure, arguing that a drive already in an attacker's hands cannot easily be recalled or updated. He said that "client-side validation is never secure" and that users should always verify security claims on their own.
Li noted one example of proper encryption: an open-source USB stick that derives its encryption key from the user's password, so reading the card alone yields nothing.
Analysis
Why this matters
- Consumers and businesses who bought these drives for sensitive data may have relied on security claims that were false or easily bypassed.
- The use of AI to rapidly reverse-engineer protection schemes shows how attackers can scale their efforts, putting more products at risk.
- The findings highlight the gap between marketing promises and actual hardware security, particularly for devices that cannot be easily patched after sale.
Background
USB storage devices marketed as "encrypted" or "secure" have a history of security failures, often using proprietary or poorly implemented cryptography. The Lenovo ThinkPlus FU100 is one example where the encryption claim was entirely false. Li demonstrated that the same software development kit used for the FU100 and nine other devices from multiple vendors could reveal passwords, and two other devices left data unencrypted on a microSD card. The full list of affected vendors was not disclosed.
Key perspectives
- Security researcher Xusheng Li: Says 'hardware security' can be pure marketing, that client-side validation is never secure, and that users should verify security claims themselves.
- Lenovo: Rated the issue severity high and issued firmware fixes, though the fix process requires contacting a China service line and physically sending in drives.
- Netac: Had no patch available as of Li's March talk, leaving its users potentially exposed.
What to watch
- Whether Lenovo simplifies its fix process or offers an automatic update for affected drives.
- If other vendors whose products were tested but not named come forward with patches or warnings.
- The potential for AI-driven reverse-engineering to expose similar flaws in other 'secure' hardware products.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedLen Lenovo’s ThinkPlus FU100 fingerprint USB stick lacked encryption, according to researcher Xusheng Li.Latest from Tom's Hardware: “Security researcher Xusheng Li found that a Lenovo ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device for data security, ended up being just a plain SD card internally, HackingPassion reports.”
- SupportedLi’s AI-assisted follow-up found backdoor accounts and hardcoded keys in other supposedly secure USB products.Latest from Tom's Hardware: “An AI-assisted follow-up last week discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.”
- SupportedThe FU100 was marketed as AES-256-encrypted but had no encryption on the card.Latest from Tom's Hardware: “sold as an AES-256-encrypted device for data security, HackingPassion reports. The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted.”
- SupportedThe FU100’s fingerprint reader only enabled the USB connection.Latest from Tom's Hardware: “The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted.”
- SupportedLi said the FU100 was “just an SD card in a fancy case.”Latest from Tom's Hardware: “The FU100 is “just an SD card in a fancy case,” Li said in a March conference talk.”
- SupportedLi said “‘hardware security’ can be pure marketing.”Latest from Tom's Hardware: “One of his takeaways: “‘Hardware security’ can be pure marketing.””
- SupportedIt is trivial for anyone with physical access to get to the FU100’s data.Latest from Tom's Hardware: “It is, as a result, trivial for anyone with physical access to get to the drive’s data.”
- SupportedLenovo put out fixes early in the year for the FU100, FU200, TU800 and TSD303.Latest from Tom's Hardware: “A later fix by Lenovo, put out early this year for the FU100, FU200 and TU800 drives, as well as the TSD303 SSD, requires owners to call a China service line”
- Partly supportedLenovo rated the advisory high severity and assigned three CVEs.Latest from Tom's Hardware: “Lenovo rated the advisory’s severity as high, and one of its three CVEs covers the configuration software”
- SupportedOne CVE covers configuration software that could let a locally logged-in user bypass device authentication and enroll an untrusted fingerprint.Latest from Tom's Hardware: “one of its three CVEs covers the configuration software, which could let a local, logged-in user bypass device authentication and enroll an untrusted fingerprint.”
- SupportedOwners must call a China service line and then send devices back for replacement or receive an on-site firmware upgrade.Latest from Tom's Hardware: “requires owners to call a China service line, then either send devices back for replacement or get an on-site firmware upgrade.”
- SupportedThe TSD303 SSD sent the correct password over USB in plain text for comparison, making it easy to capture.Latest from Tom's Hardware: “Its data actually was encrypted, but the drive sent the correct password back over USB in plain text for the software to compare, making it easy to capture.”
