Skip to content
audiotale.net
Sign in
NewsNews

Lenovo ThinkPlus FU100 'encrypted' USB stick held a plain SD card: LEN-210545 and four more weak USB tools

A researcher says the fingerprint only switched the USB link on, and an AI-assisted follow-up found fixed keys and hidden accounts in other secure USB products.

audiotale.net team

· 8 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How the AI-assisted follow-up worked
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

A Lenovo ThinkPlus FU100 fingerprint USB stick that was sold as "hardware encrypted" with AES-256 held an ordinary SD card with nothing encrypted on it, according to reverse engineer Xusheng Li. The fingerprint reader only decided whether the stick showed up on the computer. Anyone who could open the case could read the files without a finger. Lenovo has an advisory for the family (LEN-210545, rated high), and Li's October 22 follow-up shows the same class of mistake in other "secure" USB products, found with help from an AI coding agent in minutes.

Key points

  • Li says the ThinkPlus FU100 contained a plain SD card; the fingerprint sensor only switched the USB connection on, and no data on the card was encrypted (HackingPassion, Tom's Hardware).
  • Lenovo's advisory LEN-210545 covers the FU100, FU200, TU800 and TSD303 and is rated high; the fix is a service-line process, not a download (WindowsForum, Tom's Hardware).
  • In a post dated October 22, 2026, Li says OpenAI's Codex, driven through Binary Ninja, found the fixed AES-256 key in NetacFileLock in about seven minutes.
  • The same post describes two hidden accounts with fixed passwords (123456 and SECZURE.COM) on SecZure's YutianDun drives that decrypt files without the user's password.
  • Li published without coordinated disclosure for the newly tested products, so no vendor patches are known for them.

What to do

  • If you own a ThinkPlus FU100, FU200, TU800 or TSD303: treat anything stored on it as readable by whoever holds the drive, unless Lenovo has fixed your unit. Lenovo's remedy, as reported by Tom's Hardware, is to call a service line in China; Lenovo either replaces the device or upgrades its firmware on site, and advises backing up and wiping the drive first. Check Lenovo's advisory LEN-210545 on support.lenovo.com for the current instructions.
  • If you use Netac FileLock, KakaSoft USB Copy Protection, Nexcopy Copy Secure or SecZure YutianDun: do not rely on their passwords to protect sensitive files. Li reports that each can be opened without the user's password.
  • For anything that matters: encrypt the files before they reach the drive, with a tool whose design is public (for example the operating system's disk encryption, or an open-source container format), and keep the key off the stick.
  • How to tell: a drive whose lock depends on a vendor program running on your PC is not encrypting in hardware. If a vendor will not say where the key lives and what derives it, assume it is weak.

What happened

Li, who works on the Binary Ninja reverse engineering tool, took apart a ThinkPlus FU100 in 2025. The stick is marketed as AES-256 hardware encrypted and has a fingerprint sensor. Inside, according to the write-ups by HackingPassion and Tom's Hardware, was a small board with an ordinary SD card, and the data on it was not encrypted. The fingerprint check controlled only whether the stick connected to the computer. Li summed it up in a March 2026 talk at the RE//verse conference as "just an SD card in a fancy case," as quoted by Tom's Hardware.

HackingPassion reports the timeline this way: Li reported the problem to Lenovo on August 2, 2025; a temporary fix, a layer of epoxy over the SD card, was ready on August 27; a proper fix was planned for December. Epoxy makes the card harder to pull out, but it does nothing cryptographic. Lenovo later published an advisory, LEN-210545, which WindowsForum dates to January 13, 2026. Tom's Hardware says Lenovo rated it high severity and that it includes three CVEs, one of which concerns the configuration software and could let a local, logged-in user bypass device authentication and enrol an untrusted fingerprint. We could not open Lenovo's advisory page ourselves (it refused our requests), so the advisory details here are as reported by those outlets.

The second Lenovo device in the research was the ThinkPlus TSD303 external SSD. Here the data really was encrypted. The weakness was how the password was checked: when Lenovo's PC software asked the drive for it, the drive sent the correct password back over USB in plain text, and the software compared it with what the user typed. Anyone who could watch the USB traffic or the program's memory could read it. Per HackingPassion, Lenovo's first test fix, about three months after the report, replaced the plain password with a value encrypted with the SM4 cipher, but the key looked like a timestamp (in Li's test, 2021012700000000), and the PC program could derive it, so anyone who took the program apart could too. A later fix, in late 2025, has the drive check the typed password itself, so the correct one never leaves the drive.

Li says the same software kit is used by nine other devices from several vendors. According to his slides as described by HackingPassion, six of the ten sent the password in plain text, two stored data unencrypted on a microSD card and two sent the password with AES encryption that still gave it away. The vendor names on the slides are blacked out, apart from one more brand named in the talk description, Lexar's F35 Pro fingerprint stick; the slides do not say which failure belongs to which product.

Background

Hardware-encrypted USB drives have a track record of failing at the same point: the cryptography is fine in theory, but the lock is enforced somewhere an attacker can bypass. HackingPassion points to a 2022 CVE (CVE-2021-46390) for the older Lexar F35: the drive compared the password itself but sent the verdict back to the PC program, and researchers changed that verdict so a wrong password was accepted. Tom's Hardware notes this is not the first time drive makers' own encryption has failed.

Li's March talk at RE//verse showed how to break such products with time-travel debugging, which records a program while it runs so an analyst can step backwards from the encrypted bytes to the function, and then the key, that produced them. In that work he found that NetacFileLock, a program that promises to encrypt files on Netac drives with the user's password, used an AES-256 key that was a fixed 32-byte value inside the executable. The password was checked separately and played no part in the key. He reported it to Netac on October 19, 2025, according to HackingPassion, got no response and no patch, and made it public after more than 90 days.

How the AI-assisted follow-up worked

In his October 22, 2026 post on the Binary Ninja blog, Li describes pointing OpenAI's Codex at these products through Binary Ninja's MCP server. His prompt for the Netac program was a single sentence asking it to analyse the tool's cryptosystem and say whether it is secure. In seven minutes the agent reached the main flaw (the fixed key) and listed more: the program wrote the user's password into diagnostic logs, encrypted independent 16-byte blocks with no IV or chaining (ECB-style), used MD5 for password verification and for a file "signature," and used another fixed key for its SM4 option. It also explained why only part of his test file had been encrypted: in "fast mode," any file over 1,024 bytes is only partly encrypted.

Then he tried products he had not studied. The times below are the ones Li reports for his AI-assisted analysis.

Time for the AI agent to find each product's key weaknessminutes
Time for the AI agent to find each product's key weakness (minutes)
minutes
NetacFileLock (re-test)7
Nexcopy Copy Secure10
KakaSoft USB Copy Protection26

Source: Xusheng Li, Binary Ninja blog, October 22, 2026

Li's own caveat applies: the timings are not like for like. For KakaSoft, the 26 minutes covered extracting the hidden file from the drive, recovering a modified MD5 construction and proving decryption without the password, over six short prompts. For Nexcopy it was about ten minutes and five prompts. For SecZure's YutianDun, the post does not give a time.

KakaSoft USB Copy Protection 5.6.0.299 has three strengths. "Normal" does not encrypt. "High" XORs at most the first 16,385 bytes with a one-byte key derived from the password, so there are only 256 possible keys and the rest of the file stays plaintext. "Highest" advertises 256-bit Blowfish, but Li says the key comes from a salt in each file plus a fixed internal password; the agent emulated the program's modified MD5 code and recovered that password, then decrypted a test file.

Nexcopy Copy Secure (Drive Wizard 1.0.81) uses three-key Triple-DES, but the key sits in a configuration file on the drive that the viewer opens with a fixed certificate embedded in the application. The password is a separate check inside the viewer, not an input to the key.

SecZure YutianDun derives its AES key from a stored "identifier" that is unwrapped with the administrator's hashed password. Li found a hidden account called Buffer with password 123456 and another called System with the fixed password SECZURE.COM; on two tested drives both opened each drive's identifier. He calls it a backdoor from a technical perspective and adds that this does not imply malicious intent.

What it means

For buyers, the lesson is blunt: a fingerprint reader, an "AES-256" badge or a password prompt says nothing about where the key is. The test that matters is whether the data on the chip is useless without the secret. For the FU100, by Li's account, it was not.

For vendors, the second lesson is about speed. Li writes that AI has already sped up reverse engineering and vulnerability research a great deal, and that its biggest gain was finding the relevant code quickly. Products that survived because nobody had looked closely, such as small-vendor encryption tools, now face a much cheaper audit. This is one researcher's account of a handful of products, not proof that all USB encryption is broken, but it lowers the cost of checking.

For IT teams, Lenovo's remedy matters: the drive may hold exactly the data it was bought to protect, and the fix involves sending it back or having it upgraded, so the wipe-first advice is not a formality.

What we don't know yet

  • Whether Lenovo's advisory covers all four models for the SD-card problem. The no-encryption finding is documented for the FU100; for the other models the reports only confirm they are on the affected list.
  • Whether Netac, KakaSoft, Nexcopy or SecZure will respond or patch. Li did not follow coordinated disclosure for the new findings, saying a device already in an adversary's hands cannot be recalled or updated easily.
  • Which vendors the blacked-out slide entries are.
  • We have not independently reproduced any of the findings, and Lenovo's advisory page would not open for us.

What to watch next

Watch Lenovo's advisory page for updated firmware instructions, any vendor statements from the four newly named companies, and whether independent researchers repeat Li's agent-assisted audit on other "secure" storage products.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next