Lenovo fingerprint USB drive lacked encryption, researcher says
Xusheng Li's AI-assisted reverse-engineering reveals backdoor accounts and hardcoded keys in devices marketed as secure
Security researcher Xusheng Li has found that Lenovo's ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device, contained no actual encryption, the fingerprint reader only enabled the USB connection, and the internal SD card's data was unprotected. An AI-assisted follow-up then discovered backdoor accounts and hardcoded cryptographic keys in other supposedly secure USB storage products from multiple vendors.