Lenovo's 'Encrypted' Fingerprint USB Drive Found to Be Unencrypted SD Card

Unencrypted Data on 'Secure' USB Drive

Security researcher Xusheng Li found that the Lenovo ThinkPlus FU100 fingerprint USB stick, advertised with AES-256 encryption, contained only a standard, unencrypted SD card. The fingerprint reader's sole function was to enable the USB connection, leaving all data on the card exposed and easily accessible to anyone with physical access to the device.

Broader Security Flaws Uncovered

This discovery was part of a larger investigation that also revealed other vulnerabilities in supposedly secure USB storage products. A follow-up found backdoor accounts and hardcoded keys in drives from other manufacturers. Li emphasized that 'hardware security' can often be a marketing claim without substance.

Lenovo's Remediation Efforts

Lenovo released an interim fix involving epoxy over the card after the initial report. A more comprehensive fix was issued early this year for the FU100, FU200, TU800 drives, and the TSD303 SSD. This fix requires owners to contact a China service line for device replacement or an on-site firmware upgrade, with Lenovo advising data backup and drive wiping beforehand. Lenovo rated the advisory's severity as high, noting a CVE related to configuration software that could allow local users to bypass authentication.

TSD303 SSD Password Vulnerability

The same research identified a flaw in Lenovo's TSD303 external SSD. While its data was encrypted, the drive transmitted the correct password in plaintext over USB for software comparison, making it vulnerable to interception. Lenovo's initial fix used block cipher encryption with a key derived from a timestamp-like value, which was later found to be vulnerable if disassembled. A subsequent fix, released late last year, addressed this by having the drive itself verify the typed password.