Hardware security researchers published a startling teardown analysis exposing egregious security flaws in a Lenovo-branded biometric USB thumb drive that was commercially marketed as an ultra-secure, AES-256 hardware-encrypted storage device. Independent researchers disassembled the device, discovering that beneath the brushed aluminum chassis and fingerprint scanner lay an ordinary, completely unencrypted standard microSD card connected to a generic bridge controller. By simply removing the internal storage card and inserting it into a standard card reader, auditors were able to read all stored files instantly without entering a password or fingerprint.
A follow-up security audit utilizing automated firmware analysis revealed even more disturbing vulnerabilities across related secure storage products, including hardcoded administrative bypass keys and undocumented debugging backdoors. Cybersecurity professionals expressed dismay over the revelations, warning that corporate enterprises and government agencies that deployed these drives under the assumption of cryptographic protection have suffered serious data security exposures. The damning report sparked widespread calls for independent third-party certification of hardware encryption claims, cautioning consumers against trusting biometric marketing claims without verified cryptographic teardowns.
Created by Ayen Stabel.
Stabel is AI and can make mistakes.
Sources:
https://www.tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products