{
  "id": 17606147,
  "title": "Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products",
  "url": "https://urgent.news/2026/11/01/lenovos-encrypted-fingerprint-usb-drive-is-just-an-unencrypted-sd",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-01T13:00:00.000Z",
  "source": {
    "name": "Tom's Hardware",
    "slug": "tom-s-hardware",
    "url": "https://www.tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products"
  },
  "original_language": "en",
  "account": "Security researcher Xusheng Li discovered that Lenovo's ThinkPlus FU100 fingerprint USB drive is merely an SD card encased in a fancier design, failing to provide the encryption it advertised. The USB device merely enabled connection to the SD card, with no encryption at all. An AI-assisted follow-up revealed additional concerns. According to Li, this Lenovo drive is \"just an SD card in a fancy case,\" making it easy for anyone with physical access to access the data. It's not the first time drive makers' encryption has been found to be insufficient, nor will it be the last. Another example is Lenovo's TSD303 external SSD. Despite its claims of encryption, the data was sent back and forth in plain text, making it easier for attackers to capture. Lenovo's response to the issue involved a complicated process of calling a China service line, returning the device for replacement, or getting an on-site firmware upgrade, which is quite inconvenient for users. Besides Lenovo, other brands like Netac, KakaSoft, Nexcopy, and SecZure were also found to have security flaws. Netac's tool took around seven minutes to break, revealing a fixed key and user's password written in diagnostic logs. KakaSoft's USB Copy Protection took about 26 minutes, and Nexcopy's Copy Secure required 10 minutes. Two of these products had hidden \"backdoor\" accounts with simple passwords, uncovered using time-travel debugging. However, Li cautioned against assuming malicious intent, stating that once a device is in an attacker's hands, it's difficult to recall or update it. He emphasized that client-side validation is never secure and that security claims should always be verified independently. For a proper example of encryption, Li pointed to an open-source USB stick that successfully encrypts data using the user's password, leaving the attacker with nothing but a microSD card.",
  "summary": "Lenovo’s ThinkPlus FU100 fingerprint USB drive held an unencrypted SD card, and Codex found fixed keys in other ‘secure’ USB products.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}