Fingerprint USB drive and encrypted-storage flaws explained | Magica
ThinkPlus fingerprint drive stored plaintext; separate USB tests expose reachable keys
Editorial Team
••📖7 min read
A researcher found unencrypted storage in a Lenovo ThinkPlus fingerprint drive and password-bypass weaknesses in other USB protection products. Lenovo offers upgrades for affected models; the findings show why access controls alone cannot establish that files are secure.
A ThinkPlus FU100 fingerprint drive reportedly kept files unencrypted on an internal SD card despite an AES-256 hardware-encryption claim.
Separate tests found built-in credentials or recoverable keys in four USB protection products; the findings apply to the tested products and configurations.
Lenovo lists four affected ThinkPlus models and offers free service upgrades under an existing high-severity advisory.
A Lenovo ThinkPlus FU100 fingerprint USB drive advertised as using AES-256 hardware encryption instead stored files unencrypted on an internal SD card, a November 1 report on a teardown says. Lenovo already offers upgrades under a January 2026 advisory; the reported discovery and repairs date to 2025.
Security researcher Xusheng Li, whom Lenovo identifies as affiliated with Vector 35 Inc., had already published research defeating a USB product’s copy protection in November 2024. His separate October 22, 2026, technical account examines encryption and key management in four other products using AI-assisted reverse engineering—analysis of how their software works.
The findings expose two different risks: reading a storage device without authorization and extracting files that a recipient is allowed to view but supposedly cannot copy. Neither a fingerprint prompt nor the name of an encryption algorithm establishes protection against both.
Lenovo’s advisory predates Li’s separate October research into four other USB protection products and the November ThinkPlus report. Source: Lenovo.
ThinkPlus exposed files and passwords in different ways
The November report relays HackingPassion’s account of Li’s investigation. It says he dismantled the FU100 in 2025 and found the plaintext SD card. In that account, the fingerprint reader merely controlled the USB connection; it did not protect files on the removable storage. The AES-256 advertising claim is reported through that same account.
The report says Li notified Lenovo in August 2025. An interim measure covered the SD card in epoxy to make removal harder; a formal fix followed in December. Making a card harder to remove addresses physical access, whereas encrypting its contents addresses what someone can read after obtaining it.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
The ThinkPlus TSD303 external fingerprint SSD had a different failure. Its internal M.2 SSD did encrypt data, the report says, but the drive returned the correct password in plaintext over USB when Lenovo’s computer software requested it. Monitoring that traffic or inspecting the program could therefore expose the password, the report says.
A first repair sent an encrypted value instead. Li traced it to SM4 encryption with a key derived from a timestamp-like value, which he could recover. The report says a second fix in December 2025 moved password verification onto the drive itself. That chronology matters when assessing whether the failed intermediate repair describes the final reported remedy.
Lenovo’s LEN-210545 advisory, whose revision history dates its initial version to January 13, 2026, rates the vulnerabilities high severity and lists FU100, FU200, TU800 and TSD303 as affected. Its descriptions distinguish three issues:
CVE-2025-13453 permits someone with physical access to read stored data on some ThinkPlus USB drives.
CVE-2025-13454 permits a locally authenticated user to access sensitive device information through ThinkPlus configuration software.
CVE-2025-13455 permits a locally authenticated user to bypass device authentication and enroll an untrusted fingerprint.
The advisory credits Li and says a hardware-level solution is available. It does not provide technical details sufficient to independently assess the repaired design.
Encryption was present, but the keys remained reachable
Li’s October account describes four other products with distinct weaknesses. Some aim to prevent recipients from copying files they are allowed to view—a different promise from protecting a lost drive against someone without its password.
YutianDun, sold by SecZure, hides encrypted files from Windows Explorer and provides readers that claim to prevent copying, screenshots and printing. Li had previously bypassed its copy protection by running code inside its PDF reader. His newer analysis found two built-in accounts with fixed passwords that could unlock the identifier used to derive a file-decryption key. Both accounts worked on two tested drives. He calls this a technical backdoor because it bypasses the user’s password, while explicitly saying that finding does not establish malicious intent.
The same analysis found that taking 16 hexadecimal characters for AES keys limited their entropy to at most 64 bits. Li nevertheless judged brute-forcing that space impractical; the demonstrated shortcut was the built-in credentials.
The file-encryption utility NetacFileLock presented another separation between login and encryption. Li says its AES-256 implementation used a fixed key embedded in the executable, while checking the user’s password separately. Its SM4 option also used a fixed key. Additional findings included passwords written into diagnostic logs, MD5 password verification, an unkeyed MD5 file signature and independently encrypted blocks with ECB-style behavior. Li says only one-third of his test file was encrypted, and traces that partial-encryption behavior to fast mode for supported formats over 1,024 bytes. The listed formats include documents, archives, images, audio and video.
KakaSoft USB Copy Protection version 5.6.0.299 offered three security levels. Li found that Normal did not encrypt files, High scrambled only a prefix with one of 256 possible byte-sized keys, and Highest used Blowfish encryption. Even at Highest, however, he recovered a test file without its password: the key derivation depended on an embedded seed rather than a secret supplied by the user.
For Nexcopy Copy Secure, provisioned with Drive Wizard 1.0.81, Li examined the Mac viewer supplied alongside a Windows viewer. Its content used three-key Triple-DES in CBC mode. He traced a fixed value inside the viewer to an encrypted configuration containing the content key and initialization vector, the value used to initialize decryption. He then recovered the test file. The viewer’s password and device checks controlled its behavior but were not inputs to the file key. Checks intended to discourage screenshots and copying did not prevent that recovery.
These findings concern implementation failures in named products and tested configurations. They do not demonstrate a general break of the underlying encryption algorithms.
Xusheng Li’s Nexcopy diagram shows the route to the content key, separate from the viewer’s password and device checks in the tested configuration. Source: Binary Ninja.
Fast analysis does not measure how widespread the flaws are
Li says the AI coding agent Codex reproduced the known NetacFileLock fixed-key finding in seven minutes from one prompt using static analysis—examining the program without running it. KakaSoft required about two minutes to unpack its installer and seven minutes to analyze its cryptography, with two prompts. After Li supplied a protected drive, a further roughly 26 minutes and six prompts produced extraction of the hidden file and demonstrated passwordless recovery. He reports about ten minutes and five prompts for the Nexcopy analysis.
Those timings describe researcher-directed exercises rather than a controlled comparison with human analysts. Li selected targets, supplied test material and confirmed recovery. His account also recommends Binary Ninja, the analysis tool used in the workflow. The evidence supports successful recovery in these examples; it supplies neither a market-wide failure rate nor a count of exposed users or files.
Owners have a service route; other remedies remain unestablished
Lenovo directs affected users to call +86 400-640-1886 for a free upgrade. Its service team will check the serial number and guide users toward return-and-replacement or on-site firmware service. The company instructs owners to back up important files and strongly recommends deleting or formatting the device before sending it in.
For the products in his October account, Li says he did not follow conventional coordinated disclosure, arguing that devices already in an adversary’s hands cannot easily be recalled or updated. That is his rationale, rather than evidence that remediation is impossible. The account does not establish vendor responses or repaired versions for those findings.
For ThinkPlus owners, the immediate decision is whether their model needs Lenovo’s service upgrade. For buyers of the other products, the missing evidence is a vendor response and testing of repaired versions against the demonstrated recovery methods. Any assessment also needs to separate protection of a lost drive from restrictions on an authorized viewer: the latter must contend with decrypted content reaching a computer the recipient controls.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
