If the box on your USB stick promises hardware encryption, it is worth checking what that means. A security researcher found that Lenovo’s ThinkPlus FU100 fingerprint stick, sold as AES-256 encrypted, was an ordinary SD card in a case, with nothing on it encrypted.
The fingerprint reader only switched the USB connection on. Anyone holding the stick who could open the case could read the files, which is why the researcher, Xusheng Li, called it “just an SD card in a fancy case” in a conference talk.
Which Lenovo drives are affected
Li, a developer at Vector 35, reported the flaw to Lenovo on 2 August 2025. Lenovo’s first answer, on 27 August, was to glue epoxy over the SD card. Its security advisory LEN-210545 followed on 13 January 2026, rated high, covering the ThinkPlus FU100, FU200 and TU800 drives and the TSD303 external SSD. According to HackingPassion, which wrote up the research on 29 October, the advisory lists three CVEs. CVE-2025-13453 is the physical-access read of stored data, and the CVE record names all four models. The remaining two concern the drives’ companion software. CVE-2025-13454 leaks device details to a local user, and CVE-2025-13455 lets someone already signed in add a fingerprint the owner never approved.
The final fix is not a download. Lenovo asks owners to contact its service line in China, where a serial number check decides whether the drive is replaced or upgraded on site. The company advises backing up and wiping the drive first. The TSD303 did encrypt its data, yet the flaw sat in the password check: Lenovo’s PC software fetched the right password from the drive, in readable form, and compared it with what you typed. A first repair in late 2025 wrapped it in a cipher with a key anyone could derive, and a second repair, in December 2025, moved the check onto the drive itself.
Other makers’ sticks fared no better
Li’s March talk at the RE//verse conference, in his slides, said that other vendors building on the same software kit as the TSD303 were affected too. HackingPassion’s reading of the slides is that ten devices share that kit: six sent the password in plain text, two kept data unencrypted on a microSD card, and two sent the password in a way that still gave it away. The vendor names are blacked out.
In October he repeated the exercise with OpenAI’s Codex connected to Binary Ninja, and posted the results on the Binary Ninja blog on 22 October. Pointed at Netac’s NetacFileLock tool, Codex found in about seven minutes that the program encrypted with one fixed AES-256 key stored inside the executable, wrote the user’s password to its logs, and in fast mode encrypted only part of any file over 1,024 bytes. Li had reported the fixed key to Netac on 19 October 2025 and, per his slides, got no reply and no patch.
Two copy-protection products he had never studied went the same way. KakaSoft’s USB Copy Protection tool (version 5.6) offers three levels. Normal merely hides files, High XORs only the start of each file with a single-byte key, so just 256 keys exist, and Highest, which advertises Blowfish, builds its key from an internal password that Codex recovered in about 26 minutes. Nexcopy’s Copy Secure drive uses Triple-DES, but the content key lives in a config file that any copy of the viewer app can open, because the app carries a fixed certificate for it. Codex needed about 10 minutes there.
SecZure’s YutianDun drive has two hidden accounts, “Buffer” (password 123456) and “System” (a fixed password). On both drives Li tried, either one released the file key, so the administrator password was never needed. Li describes this as a backdoor purely in technical terms and does not accuse SecZure of malice. He did not warn these vendors first, arguing that a drive already in someone’s hands cannot be recalled or updated.
What owners can do
Owners of the FU100, FU200 and TU800 should assume anything stored on them is readable by whoever holds the drive until it has been serviced. For files that matter, lock them yourself before they reach any stick, with a tool that builds its key from your passphrase, such as VeraCrypt or BitLocker To Go (Windows Pro). A fingerprint reader on a stick should count only as a gate to the port. The same goes for copy-protected sticks: whoever receives one can probably read it. Neither Lenovo nor Li reports attacks on real owners, and we found no public reply from Netac, KakaSoft, Nexcopy or SecZure. We could not open Lenovo’s advisory page ourselves, so its details here are as listed in the CVE record and HackingPassion’s write-up.
