{"version":1,"type":"story","url":"https://digestai.news/story/lenovo-thinkplus-fu100-fingerprint-usb-stick-is-just-a-plain-sd-card","json":"https://digestai.news/story/lenovo-thinkplus-fu100-fingerprint-usb-stick-is-just-a-plain-sd-card.json","markdown":"https://digestai.news/story/lenovo-thinkplus-fu100-fingerprint-usb-stick-is-just-a-plain-sd-card.md","slug":"lenovo-thinkplus-fu100-fingerprint-usb-stick-is-just-a-plain-sd-card","headline":"Lenovo ThinkPlus FU100 fingerprint USB stick is just a plain SD card","summary":"Security researcher Xusheng Li reported that Lenovo’s ThinkPlus FU100, marketed as an AES‑256 encrypted device, is in fact a plain SD card inside a case. The fingerprint reader only enables USB access; no data on the card is encrypted.\n\nLi’s AI‑assisted follow‑up uncovered backdoor accounts and hardcoded keys in other supposedly secure USB products. The analysis also revealed that Lenovo’s TSD303 SSD sent the correct password over USB in plain text, allowing easy capture. Lenovo issued fixes for the FU100, FU200, TU800 and TSD303 drives, requiring owners to call a China service line and either ship devices back for replacement or receive an on‑site firmware upgrade. The company advises backing up data first and wiping the drive before sending it in.\n\nThe reverse‑engineering work used OpenAI’s Codex to break several vendors’ protection schemes: Netac’s tool took about seven minutes, KakaSoft’s 26 minutes, and Nexcopy’s 10 minutes. SecZure’s YutianDun contained two hidden backdoor accounts with simple passwords. Li noted that no warnings were issued to affected vendors and that client‑side validation is never secure.","keyPoints":["Lenovo ThinkPlus FU100 marketed as AES‑256 encrypted but is just a plain SD card","AI‑assisted reverse engineering found backdoor accounts and hardcoded keys in other secure USB devices","Lenovo issued fixes requiring device return or on‑site firmware upgrade, advising data backup and wipe"],"whyItMatters":"The findings show that marketed hardware security can be misleading and that AI tools can uncover flaws quickly, underscoring the need for independent verification and stronger security standards.","category":{"slug":"hardware","name":"Hardware & Compute","url":"https://digestai.news/category/hardware"},"entities":{"companies":["Lenovo","Netac","KakaSoft","Nexcopy","SecZure","HackingPassion"],"models":[],"people":["Xusheng Li"]},"firstPublishedAt":"2026-11-01T13:00:00Z","updatedAt":"2026-11-01T13:00:00Z","sourceCount":1,"hasPrimarySource":false,"sources":[{"outlet":"Tom's Hardware","title":"Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case — AI-assisted follow-up finds a backdoor and hardcoded keys in other ‘secure’ USB products","url":"https://tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products","publishedAt":"2026-11-01T13:00:00Z","type":"press","primary":false,"lead":true}],"sourceNotes":null,"discussions":[],"thread":null,"cite":{"text":"Digest AI, \"Lenovo ThinkPlus FU100 fingerprint USB stick is just a plain SD card\", 1 November 2026, https://digestai.news/story/lenovo-thinkplus-fu100-fingerprint-usb-stick-is-just-a-plain-sd-card","publisher":"Digest AI","title":"Lenovo ThinkPlus FU100 fingerprint USB stick is just a plain SD card","datePublished":"2026-11-01T13:00:00Z","url":"https://digestai.news/story/lenovo-thinkplus-fu100-fingerprint-usb-stick-is-just-a-plain-sd-card"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}