Lenovo deceives customers: “Encrypted” USB stick is a scam
A supposedly highly secure USB stick with a fingerprint sensor from Lenovo turns out to be a deceptive package. The data that was actually supposed to be stored in encrypted form was stored in plain text on an SD card installed inside the case.
Security as pure marketing
For a long time, buyers of the Thinkplus FU100 USB stick from Lenovo were lulled into a false sense of security. The manufacturer advertised the storage medium, which is sold primarily on the Chinese market, with robust encryption according to the AES-256 standard and an integrated fingerprint reader. However, security researcher Xusheng Li discovered that the promised protection was virtually non-existent.
Anyone who opens the stick’s housing will only find a standard and completely unencrypted SD card inside. The fingerprint sensor simply functions as an electronic switch. As soon as an authorized finger is placed, the electronics activate the USB connection to the computer. Since the data on the internal memory card is in plain text, an unauthorized person can simply break open the stick, remove the SD card and read the information without any further action.
Painful security update
As HackingPassion reported, the original investigation of the device took place as early as 2025. In response, Lenovo temporarily covered the internal SD card with epoxy resin to at least make it more difficult to remove the card. An official security update followed at the beginning of 2026. In addition to the lack of encryption, the update also fixes a vulnerability in the configuration software that allowed locally logged in users to bypass device authentication and register third-party fingerprints. However, securing the hardware they have purchased is extremely complicated for affected customers. So you have to contact a Chinese service number and send the device in or have it updated on site.
More devices with vulnerabilities
In addition to the USB stick, Xusheng Li also took a closer look at the external SSD TSD303 from Lenovo. Although the data on the storage medium was actually encrypted, the system had a serious design flaw. The drive transmitted the password in plain text to the computer via the USB interface. A potential attacker only had to intercept the data traffic to get the key.
However, the software development kit on which the SSD TSD303 is based is used in nine other products from different manufacturers. According to the security researcher, most of the devices have the same vulnerability. Like Lenovo’s USB stick, two models also stored unencrypted data on micro SD cards. However, the manufacturer names are not known.
AI uncovers further gaps
To uncover further security gaps, Li used OpenAI’s Codex programming tool. Artificial intelligence helped analyze the software that is actually supposed to protect data on storage media. However, Codex discovered a built-in key in the Netac program. The software also wrote the user’s password unencrypted into diagnostic logs.
AI analysis also showed quick success with other providers. KakaSoft’s USB Copy Protection program decrypted Codex in about 26 minutes. With Copy Secure from Nexcopy, the process took around ten minutes. Based on his findings at a conference in March, Li warned that hardware security is sometimes just marketing.
Research Snipers is currently covering all technology news including Google, Apple, Android, Xiaomi, Huawei, Samsung News, and More. Research Snipers has decade of experience in breaking technology news, covering latest trends in tech news, and recent developments. Can be reached at author1@researchsnipers.com
