联想FU100指纹U盘被曝未加密
安全研究员Xusheng Li拆解发现，联想ThinkPlus FU100虽宣称采用AES-256加密，内部SD卡却未加密，指纹识别仅用于控制USB连接。联想已为FU100、FU200、TU800和TSD303提供更换或现场固件升级方案，并将相关公告评为高严重性。Li还使用OpenAI Codex配合逆向工程工具，在其他所谓安全存储产品中发现被称为“后门”的账户和硬编码密钥。
拆解结果证实FU100宣称的硬件加密无法阻止拥有设备实体访问权者读取数据，而Codex辅助测试则展示了AI工具加速存储安全机制分析的潜力。
Security researcher Xusheng Li found that a Lenovo ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device for data security, ended up being just a plain SD card internally, HackingPassion reports. The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted. An AI-assisted follow-up last week discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.
Go deeper with TH Premium: AI and data centers
- The data center cooling state of play
- The custom AI ASIC state of play
- America’s AI chip rules keep changing — and the rest of the world is paying the price
- GTC 2026: Ian Buck press Q&A transcript — VP of Hyperscale and HPC speaks out on shelving CPX and shipping LPU decode this year
- Demand for data center CPUs has surged, and AI agents are responsible
#Lenovo#ThinkPlus FU100#ThinkPlus FU200#ThinkPlus TU800#ThinkPlus TSD303#OpenAI Codex#Netac#KakaSoft USB Copy Protection#Nexcopy Copy Secure#SecZure YutianDun