Lenovo’s fingerprint USB drive looked encrypted. A teardown says the storage was plain

Lenovo’s ThinkPlus FU100 fingerprint USB drive was sold with a security pitch that sounded straightforward: fingerprint authentication, password protection and AES-256 hardware encryption. The reporting now circulating around the device says the story inside the plastic shell was much less reassuring. According to a teardown described by Gigazine and echoed in other coverage, the FU100 used a removable microSD card as its storage medium, and the files on that card were not encrypted. Fingerprint authentication, in that account, only controlled whether the drive would connect to a computer; it did not encrypt the data sitting on the card itself. That means anyone who could open the casing and remove the storage could potentially read the contents without using a fingerprint or password.

The strongest version of that claim appears in Gigazine’s write-up of researcher Xusheng Li’s work, which says Li disassembled a ThinkPlus FU100 in 2025, found a standard microSD card on the internal board, and reported that the SD card’s contents were not encrypted. Gigazine also says Lenovo’s fingerprint check only gated USB access, not encryption, so the protected front end did not protect the underlying files if the storage was accessed directly. Tom’s Hardware’s follow-up coverage reaches the same basic conclusion: the drive was marketed as AES-256 encrypted, but the internal storage was plain, removable media rather than an encrypted flash module.

That difference matters because it separates authentication from confidentiality. A fingerprint reader can stop casual use of the device, but it does not by itself protect data at rest. If the storage media can be removed and read outside the enclosure, then the practical security property buyers care about — that lost hardware does not expose files — depends on encryption actually being applied to the stored data, not just on a biometric lock at the USB interface.

What makes this case more than a branding dispute is that the reporting says the issue was not just theoretical. Gigazine says Li reported the problem to Lenovo on Aug. 2, 2025, and that Lenovo first provided a temporary mitigation on Aug. 27 by covering the SD card with epoxy to make removal harder before issuing a fuller fix later. Gigazine also says Lenovo’s later response covered the card with epoxy as an interim measure, which implies the company accepted that physical access to the storage was the core weakness. Tom’s Hardware’s article adds a second layer: Lenovo reportedly rated the advisory as high severity, and one of the CVEs covered configuration software that could allow a local, logged-in user to bypass device authentication and enroll an untrusted fingerprint.

That turns the problem from a single bad implementation into a broader trust issue. If the device’s fingerprint system can be bypassed at the software layer, and if the data on the removable storage is not encrypted at the media layer, then the product’s security model rests on multiple weak points at once. In practice, that means the drive may still be useful as a convenience accessory, but it is not the same thing as a self-contained secure storage device unless the full encryption path is verified independently.

The teardown reporting also included a second Lenovo product, the ThinkPlus TSD303 external SSD. Gigazine says that drive did encrypt stored data, but the password was sent to the computer over USB during authentication, creating a separate exposure in which the password could be observed in transit. Lenovo later changed the method so verification happened internally within the SSD. That comparison is useful because it shows two different failure modes: one device appears to have lacked encryption on the storage itself, while another appears to have implemented encryption but handled authentication in a way that leaked secrets over the wire.

For buyers, the practical lesson is not that fingerprint hardware is useless, but that it is easy to overread what it guarantees. Biometric access control can be part of a secure design, yet it does not prove the underlying data is encrypted unless the implementation actually ties access control to encrypted storage. If the storage is a removable card or module, and if the only protection is a reader gate in front of it, then physical access may still defeat the product’s headline promise.

The broader market context is not flattering to “secure USB” branding, either. Gigazine’s article says Li later used AI-assisted analysis to examine other USB protection products and found weak points such as hardcoded keys and bypassable protection in unrelated products from Netac, KakaSoft, Nexcopy and SecZure. That does not prove Lenovo’s design was identical to those products, but it does underscore the same point: security labels on removable storage are not a substitute for inspecting the implementation.

What can be said with confidence from the available reporting is narrower than the marketing claim but more useful. The FU100 was marketed as fingerprint-authenticated and AES-256 encrypted. The teardown reporting says the fingerprint function acted as an access gate, not as the mechanism encrypting the files, and that the actual data storage was a removable microSD card whose contents were not encrypted. Lenovo’s reported remediation suggests the company treated the weakness as real, but the available reporting does not include a direct company statement explaining the original design or the full scope of the fix.

For enterprise and consumer users, that means the product should not be treated as an encrypted vault on the basis of the fingerprint reader alone. If the exact unit and firmware revision matter, buyers should ask for proof of encryption at rest, not just biometric access control, and should assume that removable media can be a liability unless the implementation is independently verified.

What the reporting supports

• Lenovo ThinkPlus FU100 was marketed with fingerprint authentication and AES-256 encryption.
• Teardown reporting says the drive contained a removable microSD card and the files on it were not encrypted.
• The fingerprint reader reportedly controlled USB access, not encryption of the stored data.
• Gigazine says Lenovo issued an interim physical mitigation and later a fuller fix.
• Tom’s Hardware reports Lenovo rated the advisory high and that one CVE involved configuration software allowing a local user to bypass device authentication.

What remains unconfirmed in the captured material

• A direct Lenovo statement explaining the original FU100 design is not present in the captured sources.
• The underlying researcher PDF is referenced by the coverage but was not directly captured here.
• The precise hardware revisions affected and the full remediation details are not fully documented in the captured excerpts.

Security claim to verify: fingerprint + AES-256 encryption
Teardown claim: removable microSD, unencrypted contents
Practical risk: physical access may expose files despite biometric gating