Lenovo 'encrypted' USB is just an SD card
The gist
Security researcher Xusheng Li found Lenovo's ThinkPlus FU100 stores data on an unencrypted SD card.
Lenovo now offers replacement or firmware fixes, but only via a China service line.
How it unfolded
- 2025Xusheng Li first analyzed the Lenovo ThinkPlus FU100 and found it was a plain SD card with no encryption; an interim fix involved covering the card with epoxy.
- early 2026Lenovo issued a later fix for the FU100, FU200 and TU800 drives and the TSD303 SSD, requiring owners to call a China service line and either return devices for replacement or get an on-site firmware upgrade.
- Mar 2026Li said in a conference talk that the FU100 is "just an SD card in a fancy case" and that "'Hardware security' can be pure marketing."