AI-assisted follow-up finds backdoor in other 'secure' USB drives
3 Nov 1 8:00 AM · 10d ago · 1 article · 1 post · 2 sources · development 3 of 3
Tom's Hardware reported that an AI-assisted (Codex) follow-up investigation found a backdoor and hardcoded encryption keys in other products marketed as secure USB drives, beyond the Lenovo FU100.
“AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products”
Tom's HardwareXusheng Li Security researcherLenovo Manufacturer of the ThinkPlus FU100Codex AI tool used in the follow-up analysis
The whole story articlesposts the bright band is this development · numbered dots are the others · click one to jump
What was reported 1 claim about this development
-
first by Mastodon, 10d ago · also HN Best, HN Frontpage, Tom's Hardware
1 more headline
What people said 24 voices · best of 31 · verbatim
-
A fingerprint encrypted USB drive is just a bad concept to begin with.1. Anyone who has access to the drive likely also has a nice sample of your fingerprint on the same device.2. Hardware encryption implementations are often unknown, flawed, or completely missing. You shouldn't place trust in obscurity.3. Hardware encryption often adds an…
-
I am once again begging people to never trust any USB or other external drives with hardware encryption, it annoys me to no end when people/YouTubers push them. But also, what the actual hell Lenovo? Even I could not have predicted this level of sheer incompetency. Anyways, use VeraCrypt :) https://www. tomshardware.com/tech-industry…
-
I always thought you should encrypt any really sensitive personal information any way you can, then if you store or send it later hopefully it's not compromised. Even when your storage media is supposedly secure. What's the harm in that, there are easy to use tools to help you along. Some professions, like with lawyers and accountants, you'd think…
-
K
Whoa. Encrypted sticks that ain't encrypted. https://www. tomshardware.com/tech-industry /cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products # infosec # privacy # cybersecurity
-
I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having…
-
>The correct solution is to use free software cryptography on top of these things.If implemented correctly, "hardware" encryption can be more secure than "free software cryptography". The most obvious benefit is protection against brute-attacks, which you can't meaningfully implement with software. Not to mention added protection of biometric…
-
Normally I'd say 90% of "enterprise" hardware is same stuff consumers get but badly tested, with more bugs, and in enterprise(rack etc.) format but this is something else.Getting chip with hardware AES isn't even hard and they implemented 90% of what is needed (usb-sd card protocol and accepting the key), it's just wtf. Maybe they prompted "make a…
-
> It's crazy that Lenovo will still be trusted to build secured hardware after that.Lenovo already has an history of backdooring the devices they sell, sometimes in exchange for money. It's insane that anyone trusts them for anything.
-
So many boxes to tick, and with a company culture that leans towards box ticking and apathy (regulatory checklists without the extra checkbox “is that last checkbox a real checkbox" then you have to talk to the nerd department who's too busy for your stupid questions... Etc. Etc.) What can we expect? I'm disappointed in Lenovo for this, but my own…
-
https://github.com/hparadiz/nexus-6p-biokeyI turned an old android into a fingerprint USB and a fido2 in one shot.The fingerprint USB is actually legit since it's backed by a closed bio metric on device.
-
This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents.
-
If anyone is looking for an actually secure, open-source encrypted thumb drive that has plausible deniability hidden encrypted volumes, https://lab401.com/products/phantom-drive is interesting
-
I feel like there’s a mismatch between what this is designed for and what people are assuming it’s for (plus no doubt hyperbolic marketing). Clearly this was designed to keep your files from your roommate or kid’s prying eyes, and not to keep military secrets or your plans to overthrow the government.
-
This is a great survey of the internals of Ironkey devices:https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdfYou shouldn't trust that these things are secure.
-
I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it."How did you get the data?""It was just an unencrypted SD card inside"Not very exciting, but I guess just as accurate as reality!
-
Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.
-
I've been required to use similar products due to government regulations. Personally I never trusted them, and I would have loved to take 15 minutes poking around in them, but it was the government who mandated their use for their data so ultimately it was out of my hands.
-
Funny, a security-oriented product from a company that was caught red-handed preinstalling rootkits in their products some ten years ago. I grew up with IBM 380XD and ThinkPad was always a sign of high reliability (that machine still runs WinXP until today).
-
I chuckle a little bit on this one - SD cards are supposed to be "Secure Digital" cards... but that security was always about making it secure for media publishers to distribute DRMed content and not really about consumer security.
-
The overwhelming majority of people who use USB sticks for things are likely aware of security and the concept of encryption. But the idea of being able to use “free software cryptography on top” may as well be a trip to Mars.
-
The name "FU100" makes this seem like it is a joke product, at the customers expense. Interestingly, I haven't been able to find a product listing for this except on chinese websites like Alibaba.
-
He used codex on other devices. He just opened the Lenovo USB case no AI needed because the sd card can be read by using a reader. The USB connection is disabled/enabled by the fingerprint reader.
-
I always said that in-device encryption that you cannot verify is useless and considered those SATA drives with built-in encryption to be useless. Famous HN luminaries disagreed with me.
-
Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.
All 3 developments of Lenovo's 'encrypted' USB drive found to be a plain SD card… →
XMastodonNewswiresRedditHacker News