People relying on encrypted storage products from several vendors could face risks from fixed keys, passwords sent in plain text and hidden accounts, according to findings presented by security researcher Xusheng Li.
Li found that the weaknesses came from the way products and their software handled authentication and encryption, including a fixed key in Netac’s program, a certificate embedded in Nexcopy’s viewer app and two hidden accounts in SecZure’s YutianDun.
Li, a security researcher who develops a reverse-engineering tool and its debugger, began with Lenovo’s ThinkPlus FU100, a small black stick with a fingerprint sensor on top that could be opened with a finger or a password. The device was marketed as hardware-encrypted with AES-256.
When Li took the FU100 apart in 2025, he found a small circuit board carrying an SD card. The card’s data had no encryption, and the fingerprint reader merely enabled the USB connection.
“just an SD card in a fancy case”, Li said. He added: “‘Hardware security’ can be pure marketing”.
Li reported the problem to Lenovo on August 2, 2025. A temporary measure, a layer of epoxy over the SD card, was ready on August 27, 2025. Lenovo later released a fix early this year for the FU100, FU200 and TU800 drives and the TSD303 solid-state drive.
Lenovo rated its advisory as high severity. One of the company’s three Common Vulnerabilities and Exposures, the public system for cataloguing security flaws, concerned configuration software that could allow a local logged-in user to bypass device authentication and enrol an untrusted fingerprint.
The TSD303’s data was encrypted, Li found, although the drive sent the correct password back through USB in plain text so that the software could compare it. The software development kit used for that drive also covered nine other devices from multiple vendors.
Li presented his work in March 2026 at RE//verse, a conference for reverse engineers. He said that “client-side validation is never secure”.
In October 2026, Li connected OpenAI’s Codex, an AI programming-focused tool, to his reverse-engineering tool to examine NetacLockFile. He used Codex alongside his employer’s reverse-engineering tool against protection schemes from other vendors.
Netac’s tool took about seven minutes to break. Codex found a fixed key in the program and the user’s password recorded in diagnostic logs. Netac had issued no patch as of Li’s March talk.
Codex rebuilt KakaSoft USB Copy Protection’s key and decrypted a test file without the user’s password in around 26 minutes. It unlocked Nexcopy Copy Secure in about 10 minutes using a certificate built into the viewer application.
Li also found two hidden “backdoor” accounts with simple passwords in SecZure’s YutianDun through time-travel debugging. He gave no warning to KakaSoft, Nexcopy or SecZure.
Comments (0)