Lenovo's 'encrypted' fingerprint USB drive was a plain SD card

According to analysis by security researcher Xusheng Li, the Lenovo ThinkPlus FU100 fingerprint USB drive, sold as an AES-256 encrypted device for data security, is essentially an ordinary SD card inside. The fingerprint reader only enables the USB connection; the data on the card is reportedly not encrypted at all.

In a conference talk in March, Li described the device simply as an SD card in a stylish box. That means anyone with physical access to the drive can reach its contents with little effort. One lesson from his work, he argued, is that hardware security can sometimes be nothing more than a marketing claim.

Lenovo's fixes: from epoxy to a service hotline

The first analysis of the FU100 was carried out last year, and the interim fix was to apply epoxy over the card. Vendors' own encryption failing is nothing new, and it probably will not be the last time.

The fix Lenovo published earlier this year for the FU100, FU200 and TU800 drives and the TSD303 SSD asks users to call a service line in China, then either ship the device in for replacement or have its firmware updated on site. The company strongly recommends backing up the data first and wiping the drive before shipping it, which makes the process a considerable hassle for users.

Lenovo rated the advisory's severity as high. One of the three CVEs in the bulletin covers the configuration software and could allow a logged-in local user to bypass device authentication and enroll an untrusted fingerprint.

On the TSD303, the password traveled in plain text

The same research uncovered a different flaw in Lenovo's TSD303 external SSD. The data on this drive really was encrypted, but the correct password was sent back over USB in plain text so the software could compare it, which made the password easy to capture.

The first fix arrived three months after the initial report and used block encryption with a key derived from a timestamp-like value. But Lenovo's software could derive that key itself, so once the first software fix was taken apart it left the drive exposed, and it would not protect the data if the device were stolen. In the next fix, released late last year, the drive itself verifies the password, so the correct password never leaves the device.

The same software development kit covered nine more devices from several manufacturers. Most of them could also hand a knowledgeable attacker the password, and two left data unencrypted on a microSD card. The full list of vendors was blacked out in Li's slides.

AI-assisted reverse engineering broke more products

A follow-up study carried out last week with AI assistance turned up what Li calls backdoor accounts in another vendor's drive, and hardcoded keys in other supposedly secure USB storage products. Li used his employer's reverse-engineering tool together with OpenAI's programming-focused AI tool Codex to examine other makers' protection schemes. Some of these products offer copy protection rather than encryption in the classic sense, the aim being that the recipient can view files but not copy them.

Netac's tool fell in about seven minutes: Codex found a hardcoded key embedded in the program and noticed that the user's password was being written to diagnostic logs. In KakaSoft's USB Copy Protection, the program generated its own internal password; Codex reconstructed it and decrypted a test file in about 26 minutes without the user's password. In Nexcopy's Copy Secure, a certificate key embedded in the viewer application was exposed, and the process took roughly 10 minutes.

SecZure's YutianDun product contained two hidden backdoor accounts with simple passwords, found through time-travel debugging, in other words by stepping through a recorded timeline trace. Li's comments suggest that malicious intent should not be assumed behind such constructs.

Li did not warn KakaSoft, Nexcopy or SecZure in advance, reasoning that a drive already in an attacker's hands cannot easily be recalled and updated. Netac had no patch as of Li's March talk. He stresses that client-side verification is never secure and says users should verify security claims themselves. As an example of doing it right, he points to an open-source USB drive built around a microSD card that derives its key from the user's password, so that simply reading the card gives an attacker nothing.