Lenovo's 'encrypted' fingerprint USB drive turned out to be a plain SD card

[Distant Summer]

A security researcher has found that some secure USB drives are far less secure than advertised. Tom's Hardware reports that Lenovo's ThinkPlus FU100 fingerprint drive, sold as AES-256 encrypted, was simply an unencrypted SD card in a case, with the fingerprint reader only switching on the USB connection

Researcher Xusheng Li described it as just an SD card in a fancy case. Lenovo initially covered the card with epoxy, and later offered fixes for the FU100, FU200, TU800 and TSD303 SSD, which in China involve calling a service line for a replacement or on site firmware upgrade. Its advisory lists three vulnerabilities, rated high severity

The TSD303 SSD did encrypt data, but it sent the correct password over USB in plain text. A first fix still let software derive the key, and a later fix made the drive check the password itself so it never leaves the device

Li then used OpenAI's Codex alongside a reverse engineering tool to test other products. He broke a Netac drive in about seven minutes, Nexcopy Copy Secure in around ten and KakaSoft USB Copy Protection in about 26, and found hidden accounts with simple passwords in SecZure's YutianDun. His advice is that client side validation is never secure, and the article points to an open source design that derives its key from the user's password

The worrying part is how many products make security claims that nobody checks. AI assisted reverse engineering is making flaws much faster to find, which is good for researchers but also for attackers. Anyone relying on a secure drive should look for independent testing

Do you trust hardware encryption claims? And how should AI change the way security products are tested?

Lenovowww.tomshardware.com