CONNECT WITH US
Tech

Tech

Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case

Tom's Hardware logo

Published on

Add as a preferred source on Google
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case

Security researcher Xusheng Li found that a Lenovo ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device for data security, ended up being just a plain SD card internally, HackingPassion reports. The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted. An AI-assisted follow-up last week discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.

  • The data center cooling state of play
  • The custom AI ASIC state of play
  • America’s AI chip rules keep changing — and the rest of the world is paying the price
  • GTC 2026: Ian Buck press Q&A transcript — VP of Hyperscale and HPC speaks out on shelving CPX and shipping LPU decode this year
  • Demand for data center CPUs has surged, and AI agents are responsible

The FU100 is “just an SD card in a fancy case,” Li said in a March conference talk. It is, as a result, trivial for anyone with physical access to get to the drive’s data. One of his takeaways: “‘Hardware security’ can be pure marketing.” This isn’t the first time drive makers’ own encryption has failed, and it won’t be the last.

The original ThinkPlus FU100 analysis happened last year, with an interim fix using epoxy over the card. A later fix by Lenovo, put out early this year for the FU100, FU200 and TU800 drives, as well as the TSD303 SSD, requires owners to call a China service line, then either send devices back for replacement or get an on-site firmware upgrade.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.