he Lenovo ThinkPlus FU100 is marketed as a device featuring 256-bit hardware-level AES encryption and a built-in fingerprint scanner. You fork over your hard-earned cash for serious document security, expecting an impenetrable digital safe for your pocket.
In reality, things are far simpler and more cynical than the box advertising promises. Inside the pricey secure enclosure hides a bog-standard card reader with a memory card, and the fingerprint scanner merely authorized plugging the drive into a computer while the actual data remained completely unencrypted. Cybersecurity researcher Siyuan Li discovered major security flaws in USB drives from multiple manufacturers.
What lies beneath the pretty shell
When an everyday buyer looks at the device, they see a biometric sensor and expect enterprise-grade security. Li called the device "just an SD card in a fancy case" and noted that anyone with physical access to it can read the contents without breaking a sweat.
Li called the device "just an SD card in a fancy case" and noted that anyone with physical access to it can read the contents without breaking a sweat.
The research also covered products from other makers using the exact same software development kit as Lenovo's drives, checking a total of nine different devices. Two of the tested drives stored data completely unencrypted on microSD cards. The TSD303 external SSD did encrypt data, but during password verification, it leaked the correct combination to the computer in plain text over USB. Why even bother building complex marketing around encryption if the password is a sitting duck on the wire? The first update fixed the password transmission, but used a hardcoded key that could be recovered straight from the software. Only a later firmware version finally fixed the logic: now the drive verifies the entered password locally without sending it to the computer at all.
Cracking security with artificial intelligence
To reverse-engineer the firmware, Li used OpenAI's Codex alongside his company's tools. Code analysis tech has evolved to the point where manual analysis of third-party firmware no longer takes weeks. The Netac drive's security was cracked in about seven minutes.
The artificial intelligence found a built-in hardcoded key inside Netac's program, alongside the user password, which was being written directly into diagnostic logs.
Similar issues turned up in other popular utilities that crossed the researcher's radar during the nine-device audit. KakaSoft USB Copy Protection used an internal password generated entirely by the program itself. Nexcopy Copy Secure's defense was bypassed in about 10 minutes: the key turned out to be exposed via a certificate embedded in the file viewer application. Inside the SecZure YutianDun utility, the researcher found two hidden accounts with default passwords by using timeline-scrubbing debugging. He also skipped notifying KakaSoft, Nexcopy, and SecZure, explaining that once a flash drive falls into a bad guy's hands, it is virtually impossible to recall or patch, rendering post-facto software updates useless for hardware already out in the wild.
Should you trust manufacturers?
As an example of a more sensible approach, the researcher pointed to the open-source Phantomdrive project. It also uses a microSD card, but encrypts data with a key derived directly from the user's password, eliminating factory firmware backdoors.
Buying a premium encrypted flash drive guarantees zero data safety, turning brand trust into a liability. If you are looking for real file protection, vendor promises of military-grade security are hot air.
Key takeaways
If you buy a secure flash drive expecting your files to be locked down tighter than a vault, be prepared to find a cheap memory card inside that leaks your data to the first curious bystander. I wouldn't trust these hardware gimmicks with anything more important than a shopping list.
For comparison
The risk of complete file exposure falls entirely on the buyer the moment they pay for a supposedly secure biometric drive: the sleek casing merely hides unencrypted data access. Unlike the open Phantomdrive project, which ties encryption to the user's secret, the tested Lenovo model reduced hardware security to a basic on-off switch for a plain memory card. Brand trust in this category offers no real shield, especially when flaws baked directly into sold hardware cannot be patched after the fact.