Hardware Security Flaws Exposed
Security research found that a Lenovo ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device for data security, ended up being just a plain SD card internally. The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted. An AI-assisted follow-up discovered backdoor accounts on another maker's drive, as well as hardcoded keys in other supposedly secure USB storage products.
The FU100 is just an SD card in a fancy case, making it trivial for anyone with physical access to get to the drive's data. This highlights how hardware security can sometimes be pure marketing when proper implementation is missing.
Lenovo Recall and Firmware Fixes
Lenovo issued an advisory for the FU100, FU200, and TU800 drives, as well as the TSD303 SSD, requiring owners to contact support and either send devices back for replacement or receive an on-site firmware upgrade. Lenovo rated the advisory's severity as high, noting that one CVE covers configuration software allowing a local user to bypass device authentication and enroll an untrusted fingerprint.
Plaintext Passwords in External SSDs
The research also uncovered a different flaw in Lenovo's TSD303 external SSD. Its data was encrypted, but the drive sent the correct password back over USB in plain text for the software to compare. A later fix implemented block cipher encryption with a derived key, and a subsequent patch late last year had the drive check the typed password itself so it never leaves the hardware.
The software development kit used for the drive covered nine other devices from multiple vendors, most of which could also reveal passwords. Two additional devices left data entirely unencrypted on a microSD card.
AI-Assisted Reverse Engineering
The integration of artificial intelligence for driving reverse-engineering tools continues to increase security vulnerability disclosures. Researchers utilized AI programming tools to analyze protection schemes, successfully breaking vendor software protections and uncovering fixed keys embedded directly into compiled programs.
Copy protection mechanisms also showed weaknesses, with automated tools quickly rebuilding internal passwords to decrypt test files without user credentials. Time-travel debugging further exposed hidden backdoor accounts with simple administrative passwords across various vendor implementations.
Experts emphasize that client-side validation remains inherently insecure and users should rigorously verify security claims. Properly implemented open-source USB sticks that derive encryption keys directly from user passwords serve as a better model for secure removable storage.
