Lenovo's 'encrypted' USB drive found to be a plain SD card; AI probe finds more flaws
Researcher Xusheng Li shows the ThinkPlus FU100 fingerprint drive stores nothing encrypted, and a Codex-assisted follow-up finds hardcoded keys and a backdoor in other 'secure' USB drives.
What to know
- Lenovo's ThinkPlus FU100 fingerprint USB drive was sold as AES-256 hardware-encrypted but actually stores data on a plain, unencrypted SD card.
- The fingerprint sensor only toggles the USB connection on; it does not encrypt or protect any data on the card.
- Lenovo issued a stopgap fix after researcher Xusheng Li's finding became public.
- A Codex-assisted follow-up investigation found a backdoor and hardcoded encryption keys in other products marketed as secure USB drives, suggesting the problem extends beyond Lenovo.
“The fingerprint only switched the USB connection on; nothing on the card was encrypted.”
Tom's Hardware, Technology publication · Tom's Hardware ↗ · Oct 31
Xusheng Li Security researcherLenovo Manufacturer of the ThinkPlus FU100Codex AI tool used in the follow-up analysis
How it unfolded 3 developments, newest first · click a bar or a number to jump articlesposts
-
3
AI-assisted follow-up finds backdoor in other 'secure' USB drives
Tom's Hardware reported that an AI-assisted (Codex) follow-up investigation found a backdoor and hardcoded encryption keys in other products marketed as secure USB drives, beyond the Lenovo FU100.
“AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products…”
— Tom's Hardware -
4 outlets first by Mastodon, 10d ago · also HN Best, HN Frontpage, Tom's Hardware · read ↗
-
A fingerprint encrypted USB drive is just a bad concept to begin with.1. Anyone who has access to the drive likely also has a nice sample of your fingerprint on the same device.2. Hardware encryption implementations are often unknown, flawed, or completely missing. You shouldn't place trust in obscurity.3. Hardware encryption often adds an…
2 more of the top 3 · 31 posts in this stretch
-
I am once again begging people to never trust any USB or other external drives with hardware encryption, it annoys me to no end when people/YouTubers push them. But also, what the actual hell Lenovo? Even I could not have predicted this level of sheer incompetency. Anyways, use VeraCrypt :) https://www. tomshardware.com/tech-industry…
-
I always thought you should encrypt any really sensitive personal information any way you can, then if you store or send it later hopefully it's not compromised. Even when your storage media is supposedly secure. What's the harm in that, there are easy to use tools to help you along. Some professions, like with lawyers and accountants, you'd think…
-
- 1 day quiet
-
2
Infosec outlets pick up the Lenovo finding
Security news aggregators, including Packet Storm, republished the finding that the Lenovo drive sold as encrypted was a plain SD card inside.
“Lenovo ThinkPlus Fingerprint USB Drive Sold As Encrypted Was a Plain SD Card Inside…”
— packet_storm@infosec.exchange -
P
Lenovo ThinkPlus Fingerprint USB Drive Sold As Encrypted Was a Plain SD Card Inside https:// packetstorm.news/news/view/468 64 # news
-
-
1
Researcher finds Lenovo FU100 drive has no real encryption
Xusheng Li determined that the Lenovo ThinkPlus FU100, marketed as AES-256 hardware-encrypted, contains an ordinary SD card; the fingerprint sensor merely switches the USB connection on without encrypting any data. Lenovo issued a stopgap fix covering the card.
“Lenovo's ThinkPlus FU100 fingerprint stick was marketed as "hardware encrypted" with AES-256, but inside was an ordinary SD card with nothing encrypted.”
— @IntCyberDigest -
❗️ Lenovo's ThinkPlus FU100 fingerprint stick was marketed as "hardware encrypted" with AES-256, but inside was an ordinary SD card with nothing encrypted. The fingerprint only switched on the USB link, researcher Xusheng Li found. Lenovo's stopgap fix covered the card in
-
What people are saying 19 voices from 2 sites · best of 33 · verbatim
- Nov 2
-
If anyone is looking for an actually secure, open-source encrypted thumb drive that has plausible deniability hidden encrypted volumes, https://lab401.com/products/phantom-drive is interesting
-
I chuckle a little bit on this one - SD cards are supposed to be "Secure Digital" cards... but that security was always about making it secure for media publishers to distribute DRMed content and not really about consumer security.
-
K
Whoa. Encrypted sticks that ain't encrypted. https://www. tomshardware.com/tech-industry /cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products # infosec # privacy # cybersecurity
-
Funny, a security-oriented product from a company that was caught red-handed preinstalling rootkits in their products some ten years ago. I grew up with IBM 380XD and ThinkPad was always a sign of high reliability (that machine still runs WinXP until today).
-
Normally I'd say 90% of "enterprise" hardware is same stuff consumers get but badly tested, with more bugs, and in enterprise(rack etc.) format but this is something else.Getting chip with hardware AES isn't even hard and they implemented 90% of what is needed (usb-sd card protocol and accepting the key), it's just wtf. Maybe they prompted "make a…
-
He used codex on other devices. He just opened the Lenovo USB case no AI needed because the sd card can be read by using a reader. The USB connection is disabled/enabled by the fingerprint reader.
- Nov 1
-
This is a great survey of the internals of Ironkey devices:https://www.cl.cam.ac.uk/~sps32/IronKey_teardown.pdfYou shouldn't trust that these things are secure.
-
https://github.com/hparadiz/nexus-6p-biokeyI turned an old android into a fingerprint USB and a fido2 in one shot.The fingerprint USB is actually legit since it's backed by a closed bio metric on device.
-
> It's crazy that Lenovo will still be trusted to build secured hardware after that.Lenovo already has an history of backdooring the devices they sell, sometimes in exchange for money. It's insane that anyone trusts them for anything.
-
The name "FU100" makes this seem like it is a joke product, at the customers expense. Interestingly, I haven't been able to find a product listing for this except on chinese websites like Alibaba.
-
I feel like there’s a mismatch between what this is designed for and what people are assuming it’s for (plus no doubt hyperbolic marketing). Clearly this was designed to keep your files from your roommate or kid’s prying eyes, and not to keep military secrets or your plans to overthrow the government.
-
So many boxes to tick, and with a company culture that leans towards box ticking and apathy (regulatory checklists without the extra checkbox “is that last checkbox a real checkbox" then you have to talk to the nerd department who's too busy for your stupid questions... Etc. Etc.) What can we expect? I'm disappointed in Lenovo for this, but my own…
-
I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having…
-
Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.
-
This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents.
-
I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it."How did you get the data?""It was just an unencrypted SD card inside"Not very exciting, but I guess just as accurate as reality!
-
>The correct solution is to use free software cryptography on top of these things.If implemented correctly, "hardware" encryption can be more secure than "free software cryptography". The most obvious benefit is protection against brute-attacks, which you can't meaningfully implement with software. Not to mention added protection of biometric…
-
The overwhelming majority of people who use USB sticks for things are likely aware of security and the concept of encryption. But the idea of being able to use “free software cryptography on top” may as well be a trip to Mars.
-
I've been required to use similar products due to government regulations. Personally I never trusted them, and I would have loved to take 15 minutes poking around in them, but it was the government who mandated their use for their data so ultimately it was out of my hands.