Lenovo fingerprint USB drive was not encrypted, and other 'secure' USB products also failed
Owners of the affected Lenovo drives must call a China service line and return the device or take an on-site firmware upgrade, after backing up and wiping their data.
A security researcher, Xusheng Li, found that Lenovo's ThinkPlus FU100 fingerprint USB drive, marketed as AES-256 encrypted, was in fact a plain SD card in a case, with the fingerprint reader only gating the USB connection. Lenovo's later fix for the FU100, FU200, TU800 and TSD303 drives requires owners to call a China service line and then return the device or take an on-site firmware upgrade, and Lenovo advises backing up and wiping data first. The same research turned up a flaw in the TSD303 SSD, which sent the correct password back over USB in plain text, and a later fix moved the password check onto the drive itself. Li also used OpenAI's Codex on copy-protection products: Netac's tool was broken in about seven minutes through a fixed built-in key and logged passwords, and KakaSoft and Nexcopy schemes were also defeated. Separately, Li found two hidden backdoor accounts in SecZure's YutianDun using time-travel debugging, and he did not warn KakaSoft, Nexcopy or SecZure before disclosing.
Why it matters
Buyers who paid for hardware encryption were relying on a protection the device did not provide, and the fix does not reach them through a simple download. The same research found flaws in the TSD303 SSD and in copy-protection and security tools from Netac, KakaSoft, Nexcopy and SecZure, so the problem is not limited to one product. Several of these vendors were not warned before disclosure, which leaves the affected devices in users' hands without a remedy that is easy to apply.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.