Lenovo ThinkPlus FU100 fingerprint USB drive is an unencrypted SD card

Hardware security claims have taken another hit after security researcher Xusheng Li discovered that the Lenovo ThinkPlus FU100 fingerprint USB stick lacks actual encryption. Sold as an AES-256-secured drive, the device internally houses a basic SD card. The fingerprint reader merely enables the USB connection, leaving all data completely unprotected.

• The Lenovo ThinkPlus FU100 contains an unencrypted SD card hidden inside a fancy casing.
• OpenAI's Codex AI assisted in finding hardcoded keys and backdoors in other secure USB products.
• Lenovo's TSD303 external SSD transmitted passwords in plain text over USB for software comparison.
• The research demonstrates that many hardware security guarantees are merely marketing gimmicks.

Vulnerability details and manufacturer response

Following the initial findings, Lenovo issued firmware updates and advisory notices requiring users to contact service lines for replacements or on-site updates. This hardware recall process proved inconvenient as users had to back up and wipe their drives beforehand. Lenovo rated the security advisory as high severity, noting that configuration software could allow local users to bypass authentication.

Furthermore, another device by the vendor, the TSD303 external SSD, exhibited a flawed password mechanism. Although the data was encrypted, the drive sent the correct password back over USB in plain text. Initial software patches were also vulnerable to reverse engineering, prompting the company to implement on-device password verification later on.

The role of artificial intelligence in security audits

During the extended investigation, Li utilized OpenAI's Codex tool to reverse-engineer third-party protection schemes. The AI assistant successfully broke Netac's protection tools in minutes by identifying fixed keys and passwords leaked in diagnostic logs. Similar copy-protection systems from KakaSoft and Nexcopy were bypassed shortly after.

The findings underscore that client-side validation is never fully secure and manufacturers' security declarations must always be verified independently. Experts suggest treating hardware cryptographic claims with careful skepticism.