Lenovo's supposedly secure USB drives are just ordinary SD cards
What's the story
Lenovo's ThinkPlus FU100 fingerprint USB drive, touted as a highly secure device with AES-256 encryption, has been exposed as an ordinary SD card in a fancy package. The revelation was made by security researcher Xusheng Li, who found that the fingerprint reader on the device only activated the USB connection and did not encrypt any data on the card.
Security flaws
Li's findings on other manufacturers' drives
Li's investigation also found backdoor accounts on another manufacturer's drive and hardcoded keys in other supposedly secure USB storage devices.
He highlighted these vulnerabilities during a conference talk, saying that "'Hardware security' can be pure marketing."
This isn't the first time manufacturers' own encryption has failed, and it likely won't be the last either.
Fixes issued
Lenovo's temporary fix last year
In response to the security issue, Lenovo issued a temporary fix last year. It involved applying epoxy over the card.
A later solution was released earlier this year for several models including FU100, FU200 and TU800 drives as well as TSD303 SSDs.
The fix requires users to call a service line in China and either send their devices for replacement or get an on-site firmware upgrade.
Advisory details
User inconvenience and data backup issues
Lenovo has advised users to back up their data and strongly recommends wiping the drive before sending it in. This is a huge inconvenience for users.
The company rated the severity of this advisory as high, with one of its three CVEs related to configuration software that could allow a local, logged-in user to bypass device authentication and enroll an untrusted fingerprint.
Additional flaws
Vulnerabilities in TSD303 external SSD
Li's research also uncovered another vulnerability in Lenovo's TSD303 external SSD.
Although the data was encrypted, the drive sent the correct password back over USB in plain text for software comparison, making it easy to capture.
The first fix came three months after the initial report and used block cipher encryption with a key derived from a timestamp-like value.
AI impact
Codex and reverse-engineering tool used to find security flaws
Li used OpenAI's Codex, an AI programming-centric tool, with his employer's reverse-engineering tool against other vendors' protection schemes.
This led to the discovery of several other security flaws in other vendors' products.
The same software development kit used for the drive covered nine other devices from multiple vendors, most of which could also reveal passwords to a savvy actor.