Lenovo's 'Encrypted' Fingerprint USB Drive Was a Plain SD Card

Lenovo sold a fingerprint USB stick marketed as AES-256 encrypted hardware that contained no encryption at all. Security researcher Xusheng Li found that the ThinkPlus FU100 stores data on an unencrypted SD card inside a plastic shell. The fingerprint reader only switched the USB connection on and off.

Li presented his findings at a conference in March. "It's just an SD card in a fancy case," he said. Anyone with physical access to the drive can read its contents. His conclusion was blunt: "'Hardware security' can be pure marketing." HackingPassion reported the findings.

What did Lenovo fix, and when?

Lenovo first learned of the flaw last year. An interim fix applied epoxy over the SD card to block physical access. A permanent fix arrived in early 2025. It covers the FU100, the FU200, the TU800 drive and the TSD303 external SSD. Owners must call a China service line. They then send the device back for replacement or arrange an on-site firmware upgrade. Lenovo advises backing up data first and strongly recommends wiping the drive before shipping it.

Lenovo rated the advisory's severity as high. It carries three CVEs. One covers the configuration software, which could let a local, logged-in user bypass device authentication and enroll an untrusted fingerprint.

How did the TSD303 SSD fail?

The TSD303 presented a different problem. Its data was genuinely encrypted. But the drive sent the correct password back over USB in plain text for the host software to compare. That made the password trivial to capture.

The first fix came three months after the initial report. It used block cipher encryption with a key derived from a timestamp-like value. Lenovo's software could derive that key, and the fix fails if taken apart. It offers no protection for a stolen device.

A second fix, issued late last year, changed the design. The drive now checks the typed password itself. The correct password never leaves the device.

How far does the problem spread?

The same software development kit behind that drive covers nine other devices from multiple vendors. Most of them could also reveal passwords to a skilled attacker. Two of the devices left data unencrypted on a microSD card. Li blacked out the vendor names on his slides.

An AI-assisted follow-up, published last week, examined other vendors' protection schemes in detail. Li used OpenAI's Codex, an AI programming tool, together with his employer's reverse-engineering tool. The results came fast:

• Netac: broken in about seven minutes. Codex found a fixed key built into the program, plus the user's password written to diagnostic logs. Netac had no patch as of Li's March talk.
• KakaSoft USB Copy Protection: broken in about 26 minutes. The program builds an internal password itself, which Codex rebuilt to decrypt a test file without the user's password.
• Nexcopy Copy Secure: broken in about 10 minutes. Its key is unlocked by a certificate built into the viewer app.
• SecZure YutianDun: contains two hidden backdoor accounts with simple passwords, found through time-travel debugging that steps through a timeline trace. Li's comments suggest malicious intent cannot be assumed.

Copy protection differs from direct access encryption. Its intent is to let a recipient view files but not copy them. Both categories failed under the same scrutiny.

Why no responsible disclosure?

Li gave no warning to KakaSoft, Nexcopy or SecZure. He argued that a drive already in an attacker's hands cannot easily be recalled or updated. His advice is direct: "client-side validation is never secure." Users should verify security claims on their own.

He did point to one example done right. An open-source USB stick, also built on a microSD card, derives its key from the user's password. Reading the card alone gets an attacker nothing.

AI-assisted reverse engineering will keep accelerating. Expect more marketed-as-secure storage products to fail similar scrutiny as these tools spread.