GoKawiilLenovo's fingerprint-secured USB drives found to use no real encryption
Security researcher Xusheng Li discovered that Lenovo's ThinkPlus FU100 fingerprint USB drive, marketed as AES-256 encrypted, was actually just an ordinary SD card whose fingerprint sensor merely gated the USB connection rather than encrypting any data. A related flaw in Lenovo's TSD303 SSD showed the device did encrypt data but transmitted the correct password in plain text over USB for verification, making it easy to intercept.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings suggest that marketed 'hardware security' features can be largely cosmetic, leaving devices vulnerable to anyone with brief physical access despite consumer assumptions of protection. Lenovo's fix requiring customers to mail in devices or arrange on-site firmware updates shows how costly and disruptive correcting such security failures can be after products have already shipped widely.
- Lenovo's FU100 fingerprint USB drive stored data on an unencrypted SD card despite AES-256 marketing claims.
- A separate flaw in Lenovo's TSD303 SSD leaked the correct password in plain text over USB during authentication.
- Lenovo rated the issue high severity and is requiring device returns or on-site firmware upgrades to fix affected products.
Kingston IronKey D300S USB Drive — If you need actual hardware-encrypted storage rather than marketing fluff, the IronKey line is built with genuine FIPS-validated AES encryption rather than a fingerprint sensor glued onto a plain SD card. It's a solid alternative for anyone spooked by the Lenovo ThinkPlus fiasco who wants real protection for sensitive files on the go.
See Kingston IronKey D300S USB Drive on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Shane Downing, 2026-11-01
Published there as: “Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.