How did AI expose Lenovo's fake encryption and hardcoded keys in USB drives?

An AI-assisted follow-up investigation last week identified backdoor accounts on another maker’s drive and hardcoded cryptographic keys in other supposedly secure USB storage products, expanding on earlier findings about hardware security flaws. This development indicates that automated tools assisted in uncovering persistent vulnerabilities in physical devices that were previously considered secure.AI tools recently found hidden accounts and fixed passwords in USB drives that were supposed to be secureAutomated analysis revealed hardcoded cryptographic material and unauthorized access mechanisms in commercial USB storage hardware

The announcement

Security researcher Xusheng Li originally reported that the Lenovo ThinkPlus FU100 fingerprint drive was merely an unencrypted SD card in a specialized enclosure, according to the published report The device marketed as providing AES-256 encryption did not encrypt data; the fingerprint sensor simply controlled the USB connection status.reported Li described the unit as an SD card in a fancy case during a March conference talk, noting that physical access allowed trivial data retrieval.

The context

Lenovo responded to the initial findings with an interim fix involving epoxy over the card, then released formal updates early this year for the FU100, FU200, TU800 drives and the TSD303 SSD.reported These fixes require owners to contact a China service line, back up data, wipe the drive and either return the device or receive an on-site firmware upgrade. Lenovo rated the advisory severity as high, with one CVE covering configuration software that allowed local users to bypass authentication and enroll untrusted fingerprints.

Reading between the lines

The same research uncovered a separate flaw in the TSD303 external SSD, where encrypted data was protected by a password sent in plain text over USB for software comparison.reported An initial fix used block cipher encryption with a timestamp-derived key, but this remained vulnerable to physical tampering. A later fix late last year moved password checking inside the drive, ensuring the correct password never leaves the hardware.

The business case

Organizations relying on vendor-certified hardware for data protection face significant operational overhead when flaws require physical device returns and service line coordination. The discovery of hardcoded keys and backdoors via AI-assisted analysis indicates that marketing claims of hardware security may not withstand scrutiny, complicating vendor selection for secure storage solutions.