Bug Bounty

Lenovo ‘AES-256’ USB stick was a plain SD card; rivals got no warning

Lenovo’s ‘encrypted’ ThinkPlus FU100 stick held an unencrypted SD card. The fix, and a researcher’s no-warning AI follow-up, test disclosure norms.

Illustration of a padlocked USB stick with a plain memory card visible inside

A researcher has shown that a Lenovo fingerprint USB stick advertised with AES-256 hardware encryption kept its files on an ordinary, unencrypted SD card, and that Lenovo’s first fix was a blob of epoxy. His AI-assisted follow-up broke four more “secure” USB products, and he published three vendors’ flaws without warning them first.

What happened

Xusheng Li, a researcher at Vector 35, took apart a Lenovo ThinkPlus FU100 in 2025. The stick has a fingerprint reader and is sold as hardware encrypted with AES-256. Inside he found a standard microSD card holding the user’s files in the clear. The fingerprint sensor only decided whether the USB connection came up. Anyone who opened the case could read the card directly, with no fingerprint or password needed.

Li reported the problem to Lenovo on 2 August 2025. According to his conference slides, a temporary mitigation was ready by 27 August: epoxy resin poured over the SD card to make it harder to remove. Several interim fixes followed between September and November, and final fixes were verified in December 2025. Lenovo published advisory LEN-210545 in January 2026. It is rated high and lists three CVEs (CVE-2025-13453, CVE-2025-13454 and CVE-2025-13455) covering the FU100, FU200, TU800 and the TSD303 external SSD. Li presented it at RE//verse in March 2026.

On 22 October 2026 Li published a second round of research on the Binary Ninja blog. This time he used OpenAI’s Codex, driving Binary Ninja through its MCP server, against products from Netac, SecZure, KakaSoft and Nexcopy. Tom’s Hardware reported the work on 1 November and GIGAZINE followed on 2 November.

The detail

The Lenovo case shows how slowly a hardware flaw gets fixed. The TSD303 really did encrypt its data, but during login the drive returned the correct password over USB in plain text so that the PC software could compare it with what the user typed. According to WindowsForum’s account of the slides, Lenovo’s first fix came about three months after the report. It encrypted that value with SM4, but used a key derived from a timestamp-like constant that anyone taking the host software apart could recover. Only the December fix moved the password check onto the drive itself.

The remedy is just as awkward. There is no self-service update. Owners have to ring a Lenovo service line in China and then either return the device or have its firmware upgraded on site. Lenovo advises backing up and wiping the drive first. For a corporate buyer, that means couriering away the very device bought to protect sensitive data.

The AI-assisted round raises a different question. Li says Codex found the core flaw in NetacFileLock within about seven minutes of a single prompt: AES-256 was initialised with a fixed key built into the program, so the user’s password never touched the encryption. The tool also wrote that password to diagnostic logs. Li’s slides record that he reported the fixed key to Netac on 19 October 2025, got no reply, and disclosed after more than 90 days. On a SecZure YutianDun drive he found two hidden accounts with fixed passwords that could unlock files without the administrator’s credentials. Li describes that as a backdoor in engineering terms while stressing it does not show bad intent. KakaSoft’s and Nexcopy’s copy-protection products fell in roughly 26 and 10 minutes respectively.

For those last three vendors, Li writes plainly: “I did not follow the conventional coordinated disclosure process for these bugs.” His argument is that a stolen drive is beyond the reach of any recall or update, so owners gain more from learning now that their passwords may offer no protection.

Timeline of the Lenovo ThinkPlus FU100 disclosure from August 2025 report to October 2026 AI-assisted follow-up

Why it matters for UK organisations

Encrypted USB sticks are still common in UK workplaces, particularly in legal, healthcare and public sector settings. If an organisation’s removable media policy rests on a vendor’s spec sheet, this research shows the claim may describe an access screen rather than real cryptography. A lost device that the organisation believed was encrypted could then become a reportable personal data breach, and the organisation would find that out only after the event.

The disclosure angle matters too. The NCSC’s Vulnerability Disclosure Toolkit asks organisations to publish a clear reporting route, set out what a finder can expect, and use security.txt so reports reach the right people. Hardware makers that sell into the UK should hold themselves to the same standard. A vendor that cannot respond within 90 days, or whose fix requires an international phone call, gives researchers good reason to go public.

Expert view

I have some sympathy with every party here. Lenovo did engage, issued CVEs and eventually fixed the design properly. But epoxy is a physical deterrent, not a security control, and calling it a fix, even a temporary one, tells you how the product was engineered in the first place. When we test “secure” storage, we start by asking what the key is derived from. If the honest answer is “not from the user’s secret”, the rest of the marketing is decoration.

Li’s decision not to warn three vendors is the part that will divide the research community. Coordinated disclosure assumes a patch can reach the people at risk. With a stick that has already been lost, stolen or handed to a recipient, that assumption fails: no firmware update protects data sitting on a device you no longer control. For flaws that cannot be fixed in the field, I think his reasoning holds: telling users is the only mitigation. It would not hold for a server product where a patch actually protects people.

The AI element changes the economics. If a researcher can reproduce earlier reverse engineering work in minutes, so can anyone with a stolen device and a subscription. Vendors relying on fixed keys and obscurity should assume their designs will be opened up quickly.

What to do now

  1. Find affected kit. Check asset registers and procurement records for ThinkPlus FU100, FU200, TU800 and TSD303 devices, plus Netac, SecZure, KakaSoft and Nexcopy products. Withdraw them from use for sensitive data.
  2. Bring your own encryption. Use software where the key is derived from a passphrase, such as BitLocker To Go or VeraCrypt, and manage recovery keys centrally. Treat the stick as plain storage.
  3. Tighten removable media control. Under Cyber Essentials secure configuration and access control, limit USB storage to approved, centrally encrypted devices and block the rest through endpoint policy.
  4. Test vendor claims. For any “hardware encrypted” product, ask which secret the encryption key comes from and where it is stored, and check whether the vendor publishes a vulnerability disclosure policy and a security.txt.
  5. Do not count copy protection as confidentiality. Assume whoever receives a copy-protected drive can extract its contents.
  6. Check your own disclosure route. If you make or sell products, use the NCSC toolkit so researchers can reach you, and commit to response times you can actually meet.

Bottom line

A fingerprint reader on a USB stick guards the connector, not the data. Lenovo’s slow, epoxy-first response and Li’s decision to publish without warning other vendors both show that for hardware already in circulation, honest disclosure to users can matter more than the patch. UK organisations should stop trusting spec-sheet encryption and apply their own.

Sources

Related Posts