alt Hacker NewsLenovo's 'encrypted' fingerprint USB is just an unencrypted SD card in a case
Comments
Does anyone actually trust these products? Always seemed like a terrible idea to me. The correct solution is to use free software cryptography on top of these things.
Linked article: https://www.tomshardware.com/tech-industry/cyber-security/le...
Interesting those those news are quite late, probably because it (and the entire ThinkPlus USB lineup) wasn't available outside CN. The product was first announced 2019, the flaw was found Aug 2025, CVE-2025-13453 was issued early Jan, and Li's presentation was in Mar.
I can imagine some "Hollywood hacker" scene where the guy steals an encrypted USB and proceeds to break into it.
"How did you get the data?"
"It was just an unencrypted SD card inside"
Not very exciting, but I guess just as accurate as reality!
This should be illegal. And maybe it already is? What consequences will Lenovo face, if any?
Why a link to Reddit instead of the link to Tom’s Hardware?
Marketing wank made to sell e-waste to middle management.
Surely this is straight fraud?
So basically fraud? I’m sure the responsible people are getting fired and fined/jailed.
This could've been rendered relatively secure had the USB stick been potted, but I guess that would've cost an extra few cents. https://en.wikipedia.org/wiki/Potting_(electronics)
Why would they do it this way? If they're going to add a custom controller on the outside, why not make it encrypt before writing to the SD card?
Can anyone find a product listing where this was actually for sale? I couldn't.
Were semicolons in subheadings common before AI? This subheading of the TomsHardware article just seems very artificial:
> The fingerprint only switched the USB connection on; nothing on the card was encrypted.
How much hardware and even software that is supposedly used for encryption is actually backdoored?
We know that Microsoft's bitlocker had at least one backdoor. Lenovo's fingerprint USB also has backdoors.
It seems like only open source solutions actually provide encryption, like LUKS and Veracrypt. Then again, who guarantees that the executables are actually build from the source? Or that the keys aren't somehow sent over to agencies by the operating system?
TLDR, we cannot realistically trust anything in this dictatorship of mass surveillance.
Just buy a standard USB drive and encrypt it with Bitlocker. If you hate MS then use Veracrypt.
What am I missing here?
Didn't expect something this crazy but I will not trust stuff like this until I've seen a teardown. Imagine being the product manager who approved this shit
Just use veracrypt or ecrypt on any memory card. These devices don't deserve the premium they charge for on-device encryption which in this case is not even encyrypted
Well it's called FU after all...
I'm not sure what codex helped with for the Lenovo case, if all that was required was open the stick and stick the sdcard into a computer.
It's crazy that Lenovo will still be trusted to build secured hardware after that. It's not even a vulnerability at this point, I'm not sure how this could pass any form of security review, let alone having anyone review the design and approve it. They must have known it was nothing they pretended and still decide to sell it.