Security researcher Xusheng Li reported that the Lenovo ThinkPlus FU100 fingerprint USB drive functions merely as an unencrypted SD card housed in a specialized casing.reported HackingPassion reported that the fingerprint sensor only enables the USB connection, while the storage medium itself lacks any encryption, rendering physical access sufficient for data extraction.reportedThe fingerprint reader on the drive does not encrypt data; it only turns the USB connection on.The FU100’s architecture bypasses encryption entirely, using the biometric sensor solely for USB enumeration enablement.
Evidence: reported
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB productsaifleet-tomshardware
Evidence: reported
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB productsaifleet-tomshardware
The claim
Li stated in a March conference talk that the device is effectively an SD card in a fancy case, allowing trivial data access for anyone with physical possession. He concluded that hardware security marketing can be misleading. An AI-assisted follow-up last week discovered backdoor accounts on a drive from another manufacturer, alongside hardcoded keys in other secure USB storage products.
The response
Lenovo rated the associated advisory severity as high. The company released fixes early this year for the FU100, FU200, TU800 drives, and the TSD303 SSD.reported Owners must contact a China service line to arrange device replacement or on-site firmware upgrades. Lenovo advises backing up data and wiping drives before sending them in.
Evidence: reported
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB productsaifleet-tomshardware
The practical upshot
The remediation process remains inconvenient for users, requiring specific service line contact and potential hardware return. One of the three CVEs covers configuration software that allows local, logged-in users to bypass device authentication and enroll untrusted fingerprints. The situation highlights ongoing challenges in verifying hardware security claims.
Claims versus evidence
Li’s initial finding of the unencrypted SD card was verified through physical teardown, providing concrete evidence of the lack of encryption in the FU100.reported The subsequent AI-assisted discovery of hardcoded keys and backdoors in other products relies on automated analysis, which Li described as finding fixed keys. While the FU100’s lack of encryption is physically confirmed, the extent of hardcoded keys across other vendors’ products depends on the scope of the AI-assisted scan, which Li characterized as finding backdoor accounts on another maker’s drive.reported
Evidence: reported
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB productsaifleet-tomshardware
Evidence: reported
Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB productsaifleet-tomshardware
Why it matters
- Product teams must verify that hardware encryption claims match internal component specifications before procurement.
- Relying on fingerprint readers for data protection is ineffective if the underlying storage medium lacks encryption.
- Remediation processes involving international service lines and hardware returns create significant operational delays for enterprise deployments.
- Configuration software vulnerabilities allowing authentication bypass require strict local access controls to mitigate risk.
Topics: hardware security, Lenovo, USB drives, encryption, AI research
Updated
Then / now / next
Lenovo sold the ThinkPlus FU100 as an AES-256-encrypted device for data security.
Research confirms the drive is an unencrypted SD card, prompting high-severity vendor fixes.
Product teams should monitor for further AI-assisted discoveries of hardcoded keys in other storage vendors.
Story timeline
- Then Lenovo sold the ThinkPlus FU100 as an AES-256-encrypted device for data security.
- 01 Nov 2026 Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products
- Now Research confirms the drive is an unencrypted SD card, prompting high-severity vendor fixes.
- Next Product teams should monitor for further AI-assisted discoveries of hardcoded keys in other storage vendors.
The strongest doubt
Counterpoint from the sources
Li noted that this is not the first time drive makers’ own encryption has failed, suggesting such issues are recurring industry problems rather than isolated incidents.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
Does the Lenovo ThinkPlus FU100 actually encrypt data?
No, the drive contains an unencrypted SD card, and the fingerprint reader only enables the USB connection.
How do users fix the security flaws in affected Lenovo drives?
Users must call a China service line to arrange for device replacement or on-site firmware upgrades.
Did AI discover the flaws in the USB drives?
An AI-assisted follow-up to Li’s initial research found hardcoded keys and backdoor accounts in other secure USB products.
Connected stories
Reading receipt
- The ThinkPlus FU100 fingerprint drive contains only an unencrypted SD card, offering no actual data encryption.
- AI-assisted follow-up research identified hardcoded keys and backdoor accounts in other supposedly secure USB products.
- Lenovo issued high-severity fixes requiring device returns or on-site firmware upgrades for affected models.