Security researcher Xusheng Li found that Lenovo's ThinkPlus FU100 fingerprint USB stick, sold as AES-256 encrypted, is in fact a plain SD card. The fingerprint reader only enables the USB connection, and nothing on the card is encrypted, Tom's Hardware reports, citing HackingPassion. Anyone with physical access to the drive can read the data easily.
Lenovo issued a fix this year for the FU100, FU200 and TU800 drives and the TSD303 external SSD that requires owners to call a China service line and either send the device for replacement or get an on-site firmware upgrade. The company rated the severity as high. On the TSD303 the data was encrypted, but the drive sent the correct password over USB in plain text; a later fix moves the password check onto the drive itself.
In a follow-up, Li used OpenAI's Codex together with reverse-engineering tools. According to the report, Netac's protection was broken in about seven minutes after Codex found a fixed key in the software, and SecZure's YutianDun product had two "backdoor" accounts with simple passwords. Li said malicious intent should not be assumed. The full list of vendors affected through a shared development kit has not been published.