The security promise that was just marketing
When Lenovo launched the ThinkPlus line with an integrated fingerprint reader, the sales pitch was clear: AES-256 hardware encryption, biometric protection against unauthorized access, a secure archive for anyone carrying sensitive data. The consumer who bought a ThinkPlus FU100 believed that, without the registered fingerprint, their files were inaccessible. The reality, discovered by a security researcher, was much simpler — and more uncomfortable: it was an ordinary SD card inside a plastic shell with a biometric sensor that, at best, toggled the USB connection of the device on or off.
The revelation came to light in October 2026, when Xusheng Li, a reverse engineering engineer at Vector 35 and developer of debugging tools, published a detailed account on his HackingPassion blog, accompanied by a presentation at the RE//verse conference in March 2026. What Li found when he opened the FU100 was not any dedicated cryptography circuitry — it was an SD card soldered to a small circuit board, with data in plain text, no layer of protection whatsoever. The fingerprint reader did exactly one thing: it decided whether the USB controller communicated with the computer or remained silent. In a simple analogy, it is like putting a lock on the door of a vault that leaves the interior perfectly exposed.
The discovery and Lenovo's response
Li reported the flaw to Lenovo on August 2, 2025. Lenovo's initial response, as documented by Tech Prolonged, was surprisingly primitive: instead of fixing the design flaw, Lenovo simply glued epoxy over the SD card to prevent anyone from removing it physically. This fix, described by the company itself in the LEN-210545 advisory as a weakness that allows data reading by someone with physical access, did not address the root problem — it only made the device even harder to open, giving a false sense of security.
The official advisory, published January 13, 2026 and classified as high severity, covered four models: the ThinkPlus FU100, FU200, TU800 drives, and the TSD303 external SSD. Three CVEs were assigned. CVE-2025-13453 described the primary vulnerability — anyone with physical access to the device could read the stored data. CVE-2025-13454 concerned the Lenovo companion software, which exposed sensitive device information to any logged-in local user. CVE-2025-13455 was even more severe: it allowed an already authenticated user to add a new fingerprint without the owner's approval.
Lenovo's ultimate solution was equally unusual. Instead of a downloadable firmware or software update, the company instructed users to contact its customer service line in China, where a serial number verifier decided whether the drive would be replaced or upgraded in person. The company recommended backing up and wiping the drive before the procedure.
The TSD303 case: encrypted data, plain-text password
The ThinkPlus TSD303 external SSD presented a different scenario, yet equally concerning. Unlike the FU100, it did encrypt data. The weak point lay in the authentication mechanism. When Lenovo's PC software queried the drive for the password, the drive returned the correct password over the USB cable in plain text. The program then compared this value with what the user typed. The captured USB packet shown by Li displayed the test password in legible text in the last bytes of the packet — anyone with a USB sniffing device could intercept and read the password.
Lenovo sent Li three fix versions to test. In the first, three months after the initial report, the drive started sending an encrypted blob instead of the plain-text password. Li traced the code with a debugger and discovered that the blob came from SM4, a block cipher similar to AES, and its key was derived from something that looked like a timestamp. In his tests, the key was 2021012700000000 — a fixed, predictable value.
In the second fix, in December 2025, the password check was moved to the drive itself. A third fix revealed that the AES-256 key was a fixed 32-byte value embedded in the companion software's executable — the user's password played no part in key generation. Copying the program was enough to open locked files without knowing the password.
The AI-assisted follow-up: five manufacturers broken in minutes
What could have been just an isolated case of a defective product turned into a case study on the security of encrypted storage devices when Li returned to the subject in October 2026. This time, he used OpenAI Codex, connected to his reverse engineering tool, and gave it a single prompt: "this is a file encryption utility, analyze its crypto system and see if it is secure."
In approximately seven minutes, Codex found the fixed key in Lenovo's software executable. The program wrote the user's password to diagnostic logs. It checked passwords using MD5. It encrypted 16-byte blocks one by one, without an initialization vector — meaning identical input blocks produced identical output. The SM4 option used another fixed key. In fast mode, files larger than 1,024 bytes were only partially encrypted — formats like PDF, ZIP, PNG, JPEG, WAV, and MPEG were vulnerable.
Li then extended the analysis to four other manufacturers. Codex took about 10 minutes each to break the Netac, KakaSoft, and Nexopy software. The Nexopy, which sold Copy Secure drives with "hardware-enforced" protection, used Triple-DES to protect files, but the key was in a configuration file that any copy of the viewer application could open, because the app carried a built-in 32-byte certificate.
Li summarized the problem in one sentence: ten devices shared the same fault kit. Six sent passwords in plain text over USB, two kept unencrypted data on microSD cards, and two sent passwords in a way that still allowed recovery. The other manufacturers' names were obscured on the slides — which, ironically, reinforced the severity: the problem was not an isolated case, it was an industry-wide pattern.
Why this matters
Security by obscurity has never been real security. What distinguishes a real cryptographic system is that it resists even when the attacker knows the algorithm, the firmware, and the companion software — security depends solely on the key, which only the legitimate owner knows. The FU100 failed at every level. The password was interceptable. The encryption key, if it existed, was fixed and copied from the executable. The data itself, in the case of the FU100, was not encrypted at all.
The problem is compounded by the fact that fingerprint or password-enabled USB drives are sold precisely to the audience that needs protection most — professionals handling confidential documents, medical personnel with patient records, lawyers with contracts. If trust in the device is the only barrier, security dissolves the moment someone has the drive in their hands.
Security experts recommend a simple rule: count a fingerprint reader or password screen on a USB drive only as a gate to the port, unless the manufacturer demonstrates that the encryption key depends on that authentication factor. For files that truly matter, use your own encryption -- VeraCrypt, BitLocker To Go, or gpg with AES-256 -- before putting anything on the device.
The question that remains is whether the consumer security industry still needs an individual researcher, with AI assistance, to discover that its products promise more than they deliver -- or if it is time for manufacturers to acknowledge that security is not a sticker on the box.
Sources: Tom's Hardware, Tech Prolonged, HackingPassion
✓ Independent sources cross-checked and verified before publishing
