The FU100 is “just an SD card in a fancy case,” Li said in a March conference talk. It is, as a result, trivial for anyone with physical access to get to the drive’s data. One of his takeaways: “‘Hardware security’ can be pure marketing.” This isn’t the first time drive makers’ own encryption has failed , and it won’t be the last.
The original ThinkPlus FU100 analysis happened last year, with an interim fix using epoxy over the card. A later fix by Lenovo, put out early this year for the FU100, FU200 and TU800 drives, as well as the TSD303 SSD, requires owners to call a China service line, then either send devices back for replacement or get an on-site firmware upgrade. Lenovo advises backing up data first and strongly recommends wiping the drive before sending it in, which is quite an inconvenience. Lenovo rated the advisory’s severity as high, and one of its three CVEs covers the configuration software, which could let a local, logged-in user bypass device authentication and enroll an untrusted fingerprint.
The same research also turned up a different flaw in Lenovo’s TSD303 external SSD. Its data actually was encrypted, but the drive sent the correct password back over USB in plain text for the software to compare, making it easy to capture. The first fix came three months after the initial report, using block cipher encryption with a key derived from a timestamp-like value. Lenovo’s software could derive that key, and the first software fix is vulnerable if taken apart, making it not useful for protecting data if a device is stolen. A later fix, late last year, has the drive check the typed password itself, so the correct one never leaves the drive.
The same software development kit used for the drive covered nine other devices from multiple vendors, most of which could also reveal passwords to a savvy actor. In addition, two left data unencrypted on a microSD card. The full list of vendors was blacked out on Li’s slides.
Open-source stealth USB hides an encrypted partition behind an 8GB decoy drive
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products#main
- https://www.tomshardware.com/membership
- Grab a new 3D printer this Halloween weekend, with prices as low as $199
- Walmart honors massive shelf price mistake, lucky buyer gets two $2,299 CyberPowerPC gaming rigs for $1,099 each
- New AI-driven Windows malware feeds stolen data to Claude to rank victims’ assets by value, then deletes itself
- Grab a Nintendo Switch 2 with a free game for as low as $459 in this limited-time deal
- NVIDIA Cloud Partners Scale Across Europe — Sovereign, Open and Built for Safe AI Agents
Informational only. No financial advice. Do your own research.