Lenovo’s AES-256 fingerprint USB drive contained an unencrypted SD card
Security researcher Xusheng Li found that Lenovo’s ThinkPlus FU100 stored files unencrypted on a standard SD card; its fingerprint reader only controlled the USB connection. Lenovo later issued fixes for the FU100 and other devices, while Li’s follow-up research, reported by Tom’s Hardware, found hardcoded keys and other weaknesses in USB security products from several manufacturers.
Bottom line — Lenovo rated its advisory high severity; Li found Netac’s encryption tool had a fixed key and no patch was available as of his March talk.
Go deeper 7
-
GIGAZINE reports that Li told Lenovo about the FU100 flaw on 2 August 2025; Lenovo’s interim response covered the card in epoxy.
-
Tom’s Hardware says Lenovo’s later fix requires owners to contact a China service line and arrange a replacement or an on-site firmware upgrade.
-
The ThinkPlus TSD303 SSD did encrypt data, but initially sent the correct password to a computer over USB in plain text, according to Tom’s Hardware.
-
Tom’s Hardware reports that Lenovo later changed the TSD303 so the drive checks the password internally.
-
Li’s AI-assisted testing found a fixed key and passwords in diagnostic logs in Netac software in about seven minutes, according to Tom’s Hardware.
-
Tom’s Hardware reports that Codex decrypted test files without a user password in about 26 minutes for KakaSoft’s USB Copy Protection and about 10 minutes for Nexcopy’s Copy Secure.
-
Li also found two hidden accounts in SecZure’s YutianDun, Tom’s Hardware reports; the article says he cautioned against assuming malicious intent.