Researcher Finds Lenovo Fingerprint USB Unencrypted; Uses OpenAI Codex to Break Other Vendors' Protections

Security researcher Xusheng Li disclosed in a March conference talk and subsequent blog posts that Lenovo's ThinkPlus FU100 fingerprint USB drive, marketed as having AES-256 hardware encryption, actually contained only a plain, unencrypted SD card internally. The fingerprint module merely enabled the USB connection, leaving data trivially accessible to anyone with physical possession of the device. Li noted that "hardware security" can be pure marketing.

In a recent follow-up study, Li used OpenAI's coding assistant tool, Codex, combined with reverse-engineering techniques, to automatically analyze other USB storage products claiming security protections. The results showed that Netac's tool was broken in about seven minutes because it contained a fixed key built into the program and wrote user passwords to diagnostic logs. KakaSoft's USB Copy Protection software allowed Codex to rebuild its internal password and decrypt a test file in around 26 minutes. Nexcopy's Copy Secure solution was compromised in about 10 minutes, with its key unlocked via a certificate embedded in the viewer app. Additionally, SecZure's YutianDun product was found to have two hidden "backdoor" accounts with simple passwords.

Regarding the Lenovo vulnerability, the company issued a high-severity advisory requiring users to contact their China service line for a firmware upgrade or replacement, strongly advising data backup and wiping before sending devices in. For other vendors, Li stated he did not warn KakaSoft, Nexcopy, or SecZure, arguing that drives already in an attacker's hands cannot easily be recalled or updated. He advised users to verify security claims themselves, stating that "client-side validation is never secure." As of his March talk, Netac had no patch available.