Lenovo 'encrypted' fingerprint USB drive held a plain SD card inside

A researcher has shown that Lenovo’s ThinkPlus FU100 fingerprint USB drive, sold as hardware encrypted with AES-256, stored its data unencrypted on an ordinary SD card.¹² The fingerprint reader only decided whether the stick connected to the computer. The files never depended on it.²

The finding comes from Xusheng Li, who took the drive apart in 2025 and presented the work in March 2026 at the RE//verse conference.² He reported it to Lenovo on August 2, 2025. A temporary fix arrived on August 27 and consisted of epoxy over the SD card. A proper fix was planned for December.² Lenovo’s advisory LEN-210545, published January 13, 2026, rates the problem high severity and lists three CVEs, one of which covers reading stored data with physical access.³

What was affected. Lenovo’s ThinkPlus TSD303 external SSD does encrypt its data, but its password handling was weak. The drive sent the correct password back over USB in plain text for the Lenovo program to compare.² Lenovo’s first fix swapped that for an encrypted blob, but the key looked like a timestamp and Li recovered the password anyway.² A second fix in December 2025 has the drive check the password itself.³

Li’s slides list ten devices built on the same software kit. Six sent the password in plain text, two kept data unencrypted on a micro SD card, and two used AES that still gave the password away.² Another outlet puts the count at nine.⁴ Either way, most of these ‘secure’ sticks failed.

The AI part. In October 2026 Li pointed OpenAI’s Codex at several vendor programs through his reverse engineering tool. It found the fixed AES-256 key inside Netac’s file-locking program in about seven minutes.²⁴ Codex also recovered a KakaSoft copy-protection secret in roughly 26 minutes and got past Nexcopy’s protection in about ten, where the key was reachable through a certificate bundled with the viewer app.⁴ In SecZure’s software he found two hidden accounts with simple passwords.⁴ Netac had not responded to his October 19, 2025 report, so he published after 90 days.²

Seen it before: a lock whose key is taped to the door.

What you should do. If you own an FU100, Lenovo’s China service line, +86 400-640-1886, offers a free upgrade. Lenovo checks the serial number, then replaces the device or updates the firmware on site.³ Beyond that, treat the word ‘encrypted’ on a drive as a claim, not a property. Anything truly sensitive should be encrypted by software you trust before it reaches the stick, with a password the drive never handles. Li pointed to the open Phantomdrive project as a sturdier design, since it derives its key from the user’s password, so pulling the card reveals nothing.⁴

Li also notes that these flaws do not prove bad intent by the makers, and he did not notify KakaSoft, Nexcopy or SecZure, because a drive already in someone’s hands is nearly impossible to recall or patch.⁴

Our read: The lesson is not that fingerprints are weak; it is that a drive’s marketing and its internals can be two different documents. Prompt fixes like Lenovo’s are a good sign, but a silent vendor is a story, and several here stayed silent. Ask who holds the key, and check whether the drive can answer that question without help from a program on your PC.

Footnotes

1. Tom’s Hardware, “Lenovo’s ‘encrypted’ fingerprint USB drive is just an unencrypted SD card in a fancy case”. Retrieved November 1, 2026. ↩

2. HackingPassion, “Lenovo ThinkPlus Fingerprint USB Drive Sold as Encrypted Was a Plain SD Card Inside”. Retrieved November 1, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

3. IT之家, “联想 ThinkPlus 指纹识别 U 盘被曝严重安全漏洞：宣称 AES-256 硬件加密，实际数据明文保存于 SD 卡”. Retrieved November 1, 2026. ↩ ↩² ↩³

4. iXBT.com, “Защищенная USB-флешка Lenovo на деле оказалась «обычной SD-картой в красивом корпусе» — данные никак не шифровались”. Retrieved November 1, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶