Lenovo ThinkPlus FU100 secure USB drive lacks encryption

Hardware security claims often fall short of reality due to hidden design flaws and marketing shortcuts. Cybersecurity researcher Xusheng Li has conducted a comprehensive investigation into secure USB flash drives from several manufacturers, uncovering critical vulnerabilities in products from major brands including Lenovo.

• The popular Lenovo ThinkPlus FU100, marketed with AES-256 hardware encryption and a fingerprint scanner, is actually just a basic SD card reader.
• Lenovo's external SSD TSD303 transmitted user passwords in plaintext over USB during verification.
• Using AI-powered reverse engineering tools allowed researchers to crack the Netac flash drive protection in just seven minutes.
• Out of nine tested drives from various brands, many stored data without encryption or possessed severe software loopholes.

Lenovo devices and security flaws

The Lenovo ThinkPlus FU100 was promoted as a secure device featuring hardware-based AES encryption and biometric authentication. However, teardowns revealed that the fingerprint scanner merely acts as a gateway to permit computer connection, while the actual data files reside on a standard, completely unencrypted SD card. Anyone with physical access to the drive can easily remove the card and read its contents.

Another Lenovo product, the TSD303 external SSD, did encrypt data but suffered from a major flaw: during password verification, it transmitted the correct combination to the computer in plaintext over USB. While an initial firmware update attempted to fix the transmission, it relied on a weak key recoverable from the software. Only a later firmware version finally moved password verification directly onto the secure drive itself.

The role of AI in reverse engineering

To analyze the hardware and software, the researcher utilized OpenAI's Codex alongside custom tools to automate vulnerability discovery and accelerate reverse engineering. For instance, the protection on the Netac USB drive was cracked in about seven minutes because an AI discovered a hardcoded constant key and found that user passwords were being logged in diagnostic files.

Similar issues were found in copy-protection software. KakaSoft USB Copy Protection relied on an internally generated password algorithm that Codex reconstructed to decrypt test files without the user password in roughly 26 minutes. Nexcopy Copy Secure was bypassed in about 10 minutes because its encryption key was accessible via a certificate embedded directly in the file viewer application.

Implications for the tech industry and users

These findings highlight systemic security flaws in the software development kits and ready-made protection schemes utilized by various hardware vendors. The researcher chose not to notify certain utility developers, noting that physical storage devices already in the hands of malicious actors are nearly impossible to recall or patch.

As an example of a more robust alternative, the researcher highlighted the open-source Phantomdrive project. It also utilizes a microSD card inside the enclosure, but encrypts data using a unique key derived from the user's password, ensuring that simply extracting the storage card will not expose its contents.