Lenovo FU100 Fingerprint USB Drive Found Unencrypted
Security researcher Xusheng Li's teardown found that the Lenovo ThinkPlus FU100 fingerprint USB drive advertised AES-256 encryption uses an unencrypted SD card, with the fingerprint reader only controlling USB access. Lenovo issued fixes for the FU100, FU200, TU800 and TSD303, including replacement or on-site firmware upgrades through its China service line, and rated the related advisory as high severity. Li also used OpenAI's Codex with a reverse-engineering tool to identify alleged backdoor accounts and hardcoded keys in other purported secure storage products.
The teardown shows that the FU100's advertised hardware encryption did not protect data from someone with physical access, while the AI-assisted follow-up demonstrates how coding tools can accelerate the analysis of storage and copy-protection mechanisms.
Security researcher Xusheng Li found that a Lenovo ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device for data security, ended up being just a plain SD card internally, HackingPassion reports. The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted. An AI-assisted follow-up last week discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.
Go deeper with TH Premium: AI and data centers
- The data center cooling state of play
- The custom AI ASIC state of play
- America’s AI chip rules keep changing — and the rest of the world is paying the price
- GTC 2026: Ian Buck press Q&A transcript — VP of Hyperscale and HPC speaks out on shelving CPX and shipping LPU decode this year
- Demand for data center CPUs has surged, and AI agents are responsible
#Lenovo#ThinkPlus FU100#ThinkPlus FU200#ThinkPlus TU800#ThinkPlus TSD303#OpenAI Codex#Netac#KakaSoft USB Copy Protection#Nexcopy Copy Secure#SecZure YutianDun