Lenovo fingerprint USB stick found to hold unencrypted SD card

Security researcher Xusheng Li found that the Lenovo ThinkPlus FU100 fingerprint USB stick, marketed as AES-256 encrypted, contained a plain unencrypted SD card, according to tomshardware.com. The fingerprint reader on the FU100 only enabled the USB connection and did not encrypt any data on the card.

Lenovo issued a fix early this year for the FU100, FU200 and TU800 drives and the TSD303 SSD. Owners are required to call a China service line for replacement or an on-site firmware upgrade. Lenovo rated the advisory's severity as high, and one of its three CVEs concerns configuration software that could let a local logged-in user bypass authentication and enroll an untrusted fingerprint.

Li also found that the TSD303 external SSD encrypted data but sent the correct password over USB in plain text for the software to compare. In a March conference talk, he said the FU100 is just an SD card in a fancy case.

In his follow-up research, Li used OpenAI Codex with reverse-engineering tools to break Netac's tool in about seven minutes, finding a fixed key and the user's password in diagnostic logs. Codex took about 26 minutes to rebuild KakaSoft's internal password and decrypt a test file, and about 10 minutes to unlock Nexcopy's Copy Secure key via a certificate in the viewer app. SecZure's YutianDun was found to have two hidden backdoor accounts with simple passwords.

The original ThinkPlus FU100 analysis was done last year, with an interim fix applying epoxy over the card. The TSD303's first fix came three months after the initial report, using block cipher encryption with a key derived from a timestamp-like value. A later TSD303 fix, late last year, made the drive check the typed password itself so the correct one never leaves the drive.