Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case
- ID
- 41713
- Status
- summarized
- Published
- 01 Nov 2026, 9:00 PM
- Fetched
- 01 Nov 2026, 10:31 PM
- Provider
- Tom's Hardware
- Category
- technology
- Original URL
- https://www.tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products
- Source URL
- https://www.tomshardware.com/feeds/all
Summary
- Score
- 3.5
- Created
- 01 Nov 2026, 10:31 PM
- Tags
- Audience
- developerssaas_founders
What happened
Tom's Hardware reports that a Lenovo fingerprint USB drive sold as AES-256 encrypted actually contained a plain, unencrypted SD card inside. An AI-assisted follow-up also reportedly found a backdoor and hardcoded keys in other 'secure' USB products.
Why it matters
If you move backups or client data on hardware-encrypted USB drives, do not treat an 'AES-256' label as proof of protection: this reported case had no encryption at all. Before trusting such a drive, test that its contents are unreadable without the fingerprint or credential, and keep software-level encryption as the control you actually rely on.
Discussion angle
What hardware trust assumptions do you make in backup or data-transfer workflows, and how would you test a 'secure' drive before putting client data on it?