Lenovo’s fingerprint-encrypted USB flash drive was revealed to be useless: the data can be read by removing the casing

Abstract:

According to technology media Tom’s Hardware, security researchers discovered that a Lenovo ThinkPlus FU100 fingerprint USB flash drive claimed to use AES-256 encryption technology, but the SD card storing data inside was not actually encrypted. Someone who gets the device can potentially bypass fingerprint recognition and read data simply by removing the casing.

Security researcher Xusheng Li disassembled FU100 last year and presented the results at a conference in March this year. He found that the fingerprint recognition function of this USB flash drive was only used to control the USB connection, and the data on the memory card was saved in clear text.

Li describes the FU100 as "an SD card in a fancy case." He believes that this case shows that the "hardware security" claimed by some products may be just marketing.

Lenovo subsequently released repair solutions for FU100, FU200, TU800 USB flash drives and TSD303 mobile solid-state drives. Users need to call the Chinese service hotline and choose to send the device back for replacement or wait for on-site firmware upgrade. Lenovo recommends that users back up their data in advance and strongly recommends wiping the device before sending it back.

Lenovo rates the severity of the relevant security advisory as

high

. Among the three vulnerabilities involved in the announcement, one is related to the configuration software and may allow logged-in local users to bypass device authentication and enter unauthorized fingerprints.

Li also discovered another vulnerability on Lenovo's TSD303 mobile solid-state drive. Unlike the FU100, the data on the TSD303 is encrypted, but the hard drive was previously connected via USB and sent the correct password in clear text to the software for comparison, and the password may be intercepted.

The first fix was rolled out about three months after the vulnerability was reported, but researchers found that the solution used an encryption key that could be derived from a timestamp-like value and still failed to effectively protect data if the device was stolen. A follow-up fix, rolled out late last year, allows the drive to verify user-entered passwords on its own so that the correct password never leaves the device.

The report stated that the same software development kit is also used by nine other devices from multiple manufacturers, and most of these products may also leak passwords to attackers with corresponding technical capabilities. The researchers also discovered that two other devices saved unencrypted data on microSD cards. In the slides presented by Li, the names of relevant manufacturers have been obscured.

In a recent follow-up study using artificial intelligence, Li used OpenAI's programming tool Codex, in conjunction with a reverse engineering tool developed by his employer, to test storage products and protection software from other manufacturers.

Reports indicate that Codex opened in about

7 minutes

We broke into a Netac tool and found that a fixed key was built into the program, and the user password was also written into the diagnostic log. As of the time of Li's speech in March this year, Netac had not yet released a patch. The report did not indicate whether the product has now been fixed.

The study also involved two file copy protection products. Such products allow the recipient to view the files but attempt to prevent them from copying the contents. Codex in about

26 minutes

Reconstructed the password generated by the KakaSoft USB Copy Protection program and decrypted a test file without the user's password. Nexcopy's Copy Secure protection mechanism takes about

10 minutes

was breached within.

In addition, Li discovered two hidden accounts with relatively simple passwords in SecZure's YutianDun product. According to the report, these accounts are called "backdoors" by Li, but this cannot be used to determine that the manufacturer has malicious intentions.

Li stated that he did not notify KakaSoft, Nexcopy or SecZure of the relevant findings in advance. He believes that USB flash drives that have fallen into the hands of attackers are difficult to recall or update.

He also cited an open source USB flash drive as a positive case. Although the device also uses a microSD card, it implements encryption correctly and generates the key from the user's password. The attacker reads the memory card alone and cannot directly obtain the data in it.