Lenovo's ThinkPlus FU100 fingerprint USB drive stores data with no encryption at all, according to findings presented by researcher Li at a March conference talk. Li described the product as an SD card inside a decorative enclosure, which means anyone who physically obtains the drive can reach its contents without much effort. He drew a broader conclusion from the case: hardware security claims can amount to nothing more than marketing. The FU100 analysis was first conducted last year, and it is not the first instance of a storage vendor's own encryption falling short.
Lenovo's remediation for the FU100, the FU200 and TU800 drives, and the TSD303 SSD arrived early this year and requires owners to call a service line in China. Customers must then either return the device for replacement or arrange an on-site firmware upgrade. Lenovo advises backing up data beforehand and strongly recommends wiping the drive before sending it in. The company rated the advisory as high severity, and one of its three CVEs concerns the configuration software, which could allow a locally logged-in user to bypass device authentication and register an untrusted fingerprint.
Li's research also uncovered a separate problem in the Lenovo TSD303 external SSD. That drive did encrypt its data, but it transmitted the correct password back over USB in plain text so the software could compare it, making the password easy to capture. The first fix, issued three months after the initial report, used block cipher encryption with a key derived from a timestamp-like value. Because Lenovo's software could derive that same key, and the first software fix fails when taken apart, it offers no real protection for a stolen device. A later fix, released late last year, has the drive verify the typed password internally, so the correct one never leaves the drive.
The software development kit tied to the drive was used across nine other devices from multiple vendors, most of which could also expose passwords to a knowledgeable attacker, and two of which left data unencrypted on a microSD card. The vendor names on Li's slides were blacked out, leaving the affected products unidentified for the audience.
Li relied on OpenAI's Codex, an AI programming tool, together with his employer's reverse-engineering tool to test other vendors' protection schemes. Netac's tool fell in roughly seven minutes after Codex found a fixed key embedded in the program and the user's password written to diagnostic logs. KakaSoft's USB Copy Protection, which builds its own internal password, was rebuilt to decrypt a test file without the user's password in about 26 minutes. Nexcopy's Copy Secure took about 10 minutes, with its key unlocked by a certificate built into the viewer app.
SecZure's YutianDun contained two hidden backdoor accounts with simple passwords, found using time-travel debugging to step through a timeline trace; Li's remarks suggest malicious intent should not be assumed. Li did not warn KakaSoft, Nexcopy or SecZure, reasoning that a drive already in an attacker's hands cannot easily be recalled or updated. He said client-side validation is never secure and that users should verify security claims themselves. Netac had no patch as of his March talk.
More cybersecurity news from TechManNews.
