Lenovo's ThinkPlus FU100 was sold as a fingerprint drive with AES-256 hardware encryption. When reverse engineer Xusheng Li took one apart in 2025, he found an ordinary SD card on the circuit board, and nothing on it was encrypted. [1] The fingerprint reader had exactly one job: deciding whether the stick connected to the computer or stayed silent. The files never depended on it. [1] A printed cipher name and a fingerprint sensor prove little on their own; what decides whether an "encrypted" drive protects anything is where the key sits and whether the password ever leaves the device. The FU100 case shows what that difference looks like in hardware, and it gives any buyer a way to check it.
The case returned to public view on November 2, when Phoenix Technology, citing Tom's Hardware, reported that a person who opens the FU100's case can bypass the fingerprint check and read the stored data in plain text. [2] Lenovo's remediation for the flaw covers four products: the FU100, FU200 and TU800 USB drives and the TSD303 portable SSD. [2] Li, who develops reverse-engineering tooling, presented the teardown at the RE//verse conference in March 2026 and posted the slides; on October 22 he published a follow-up on Binary Ninja's blog that extends the research with AI assistance. [3] [4]
The Fingerprint Only Switched the USB Connection On
The FU100 failed in the most basic way available: there was no encryption layer at all. Sales listings marketed it as "hardware encrypted with AES-256" and promised fingerprint protection, password protection and anti-leakage; the teardown showed the hardware behind those claims. [1] The sensor controlled the USB connection, nothing more. Pull the SD card, slot it into any reader, and every byte is readable. [1] [5] Lenovo's own advisory later described the flaw as a weakness that lets someone with physical access read the data stored on the drive. [1]
The TSD303 portable SSD shows a second failure mode, and a subtler one. Its data is genuinely encrypted: inside sits a standard M.2 SSD, and the contents are protected. [1] The weak point was the password. When the bundled program on the computer asked the drive for it, the drive sent the correct password over the USB cable in plain text, so the program could compare the two. [1] Whoever could watch that traffic, or read the memory of that program, held the password to the drive.
The first TSD303 fix arrived about three months after Li's report, and it failed a different way. The drive began sending the password as an SM4-encrypted blob instead of plain text, but the key was derived from a timestamp-like value; in Li's test it was 2021012700000000. [1] [2] A program that can derive the key can be taken apart, and so can the key. A later revision moved the comparison into the drive itself, and the correct password no longer leaves the device. [2]
These cases sort into three checkable categories: the data was never encrypted, as on the FU100; the data was encrypted but the password crossed the wire, as on the pre-fix TSD303; or the key was derivable from values the software itself holds, as in the first SM4 fix. Each category fails differently, and each was found without privileged access — by opening the case, capturing the USB traffic, or reading the software that handles the password.
One Software Kit, Ten Devices
The FU100 was the entry point to a wider pattern. Li's slide lists ten devices built on the same software kit, with vendor names blacked out: six sent the password in plain text, two stored data unencrypted on a micro SD card, and two wrapped the password in AES in a way that still exposed it. [1] Phoenix's report says the same kit reached nine devices from other vendors. [2] The official description of Li's talk names one more brand, Lexar, whose F35 Pro fingerprint drive was among the devices he researched. [1] Lexar's older F35 already carried CVE-2021-46390, published in 2022, after three researchers showed that the drive's own password comparison could be overridden so a wrong password passed. [1]
The October follow-up adds scale on the attacker's side. Li reports that AI reproduced his earlier research in seven minutes using static analysis. [3] In the new work, OpenAI's Codex coding tool broke Netac's protection utility, finding a hard-coded key and user passwords written into diagnostic logs; Netac had shipped no patch as of the March talk, and the report leaves its current status open. [2] KakaSoft's USB Copy Protection fell in about 26 minutes, Nexcopy's Copy Secure in about 10. [2]
In SecZure's YutianDun drive, Li found two hidden accounts, Buffer with the password 123456 and System with SECZURE.COM. Both accounts opened the drive's identifier on two tested units, and with Buffer he confirmed the chain one step further, from identifier to the AES key that decrypts files. Buffer is hidden from the user-management screen. [2] [3] He called them backdoors, and the report is careful with the word: the finding alone does not prove malicious intent by the vendor. [2] The bundled software turned passwords into keys with fast MD5/HMAC-MD5 rather than a deliberately slow scheme such as PBKDF2. [3] For the vendors in that October post, Li skipped the conventional coordinated-disclosure route — private notice to the vendor first, public release later — reasoning that a drive already in someone's hands cannot be recalled or updated easily, and publishing directly so potential users know the limits. [3]
Lenovo's Advisory Is Real but the Documented Fix Path Runs Through China
Lenovo issued advisory LEN-210545 on January 13, 2026, listing three CVEs and rating the issues high. [5] One of the three sits in the configuration software: a user already logged in to the machine could bypass device authentication and enroll an unauthorized fingerprint. [2] On the FU100 itself, Li reported the flaw on August 2, 2025; on August 27 Lenovo had a temporary fix ready, a layer of epoxy over the SD card, with a proper fix planned for December 2025. [1] The epoxy makes the card harder to remove. The card's contents stay readable.
The documented remediation runs through Lenovo's China channel: the advisory directs FU100 owners to hotline 400-640-1886 for a free replacement or an on-site firmware upgrade, and Lenovo advises backing up data first and erasing the drive before sending it in. [5] [2] The published reports name only a China hotline, so owners elsewhere would need Lenovo's local support to confirm the same service. [5]
Three Questions Separate Real Encryption From a Box Claim
The FU100 case hands buyers a working test, and every part of it maps to something that actually failed here. Does the password ever leave the drive? The pre-fix TSD303 sent the correct password over USB for the host to compare; a drive that checks the password internally, as Lenovo's later TSD303 firmware does, avoids that exposure. [1] [2] What remains if the storage gets pulled out? On the FU100, everything on the card was readable; Li's positive example is an open-source drive that derives its key from the user password, so the micro SD card alone yields nothing useful. [1] [2] How does the software turn a password into a key? The YutianDun software's fast MD5/HMAC-MD5 derivation is the weak version of that answer — it makes every guess cheap — while a deliberately slow scheme such as PBKDF2 exists to make each guess expensive. [3]
A fingerprint reader answers who may open the drive; it says nothing about what happens after it opens. A buyer can run the three checks without a lab: a vendor's public documentation should say where the password is checked and how keys are derived, and independent teardowns, CVE entries and advisories cover the rest. Where nothing verifiable turns up, the drive itself offers no answer, and files that matter need encryption the buyer controls before they go on it. The FU100's marketing promised AES-256, fingerprint protection and anti-leakage, and the card inside was plain. [1] Li's slide advice at RE//verse — do not trust encrypted USB drives, check what the vendor claims yourself — now has a concrete form: where the key sits, whether the password travels, and what is left if the card comes out. [1] [4] Those three answers, not the claim on the listing, are what protected data on the FU100 would have required. [1]