encrypted-usb.fail

Research index

Breaking Encrypted USB Drives

This page collects my research on encrypted USB drives and USB copy-protection software. Despite the promise to keep your files safe, they often fail completely.

The failures take different forms: files stored without encryption, passwords exposed over USB, fixed keys and backdoor accounts in software, and sign-in checks that can be bypassed with a direct device command.

Xusheng Li

Opened Lenovo ThinkPlus FU100 USB drive with its internal microSD card visible
Lenovo ThinkPlus FU100, opened to show its internal microSD card.

Findings by vendor#

The affected products have different failure modes. A password bypass, exposed key, and unencrypted media are distinct findings.

Lenovo

ThinkPlus FU100 · TSD303

FU100: Files were stored without encryption on an internal SD card; fingerprint authentication gated the USB connection. TSD303: The drive originally returned the correct password in plaintext to host software over USB. A first fix still exposed it through reversible encryption. Lenovo fixed the vulnerabilities, issued an advisory, and assigned three CVEs.

Talk slidesLenovo advisoryCVE-2025-13453CVE-2025-13454CVE-2025-13455

Netac

NetacFileLock

Files are encrypted with AES, but the key is fixed and hardcoded in the executable. Fast mode encrypts only one third of certain file types. The user password is checked separately from the content key.

Technical write-upTalk slides

SecZure

YutianDun

The tested drives contained a backdoor in the technical sense: two built-in accounts with fixed passwords held wrapped copies of the content identifier, allowing decryption without the administrator password. This does not imply malicious intent. An earlier study bypassed the bundled reader's copy protection from inside its process.

Technical write-upEarlier article

KakaSoft

USB Copy Protection 5.6.0.299

“Normal” did not encrypt files; “High” scrambled only a prefix. For the tested “Highest” Blowfish setting, the software derived its own decryption password from an embedded seed. I used that password to recover a protected test file without knowing the user's password.

Technical write-up

Nexcopy

Copy Secure · Drive Wizard 1.0.81

The viewer held a fixed value that decrypted a configuration file containing the content key and IV needed to decrypt protected files.

Technical write-up

PIODATA

SecureX · PC Secure Log-in Software 1.3.2.7

The Google/Apple sign-in and PIN checks could be bypassed, allowing the drive to be unlocked and its files read. The unlock value was calculated with SM3 from device data readable before login and a constant in the Windows app. SM3 is an unusual choice for a company that lists a U.S. address.

Newly published result

Lexar

F35 Pro fingerprint USB

The USB device transfers the correct user password to the Windows FingerTool software in plaintext. That password can then be used to unlock the drive. Lexar confirmed the issue, provided a firmware-updated replacement, and I verified that the issue was resolved on that replacement.

Newly published result

Shared SDK survey

Additional devices

My broader survey found the same SDK family used by Lenovo devices across these products.

VendorDeviceObservation
MoveSpeed128GBCleartext password disclosure
MoveSpeedGD10 1TBUnencrypted storage on microSD
EAGET128GB USBCleartext password disclosure
EAGETFM6 1TBCleartext password disclosure
EAGET64GBAES-encrypted password sent to computer
NEWQFS01 128GBCleartext password disclosure
NEWQD3 32GBAES-encrypted password sent to computer
onemodern256GB PSSDCleartext password disclosure

RE//verse slides

Publications#

My talks and writing on this research.

  1. 2026 · Article
    Discovering a Backdoor and Flaws in More Encrypted USB Drives

    Binary Ninja blog; SecZure, Netac, KakaSoft, and Nexcopy.

  2. 2026 · Talk
    Breaking Encrypted USB Drives with Time-Travel Debugging

    RE//verse 2026. Slides.

  3. 2024 · Article
    Examining USB Copy Protection

    Paged Out!, issue 5. Earlier work on the SecZure reader.

CVEs#

  1. Lenovo · 2025
    CVE-2025-13453

    Physical access to certain ThinkPlus USB drives could allow reading stored data.

  2. Lenovo · 2025
    CVE-2025-13454

    A locally authenticated user could access sensitive device information through ThinkPlus configuration software.

  3. Lenovo · 2025
    CVE-2025-13455

    A locally authenticated user could bypass device authentication and register an untrusted fingerprint.

Media coverage and discussion#

155 entries in 22 languages. A short selection from the Hacker News discussion and the reporting collected in my coverage archive.

Read more

More reports

Discussion and syndication

Automated summaries and indexes

Takeaways#

  1. Do not trust an encrypted USB drive unless you can verify how it protects your files. Software such as VeraCrypt can provide strong encryption, and its source code can be examined for security.
  2. Several vendors have issued fixes, yet I have still found older vulnerable versions for sale online. Already produced stock may remain unmodified, so a published fix does not guarantee that the device you buy is fixed. This is another reason to be cautious about encrypted USB drives.

About#

I’m Xusheng Li, a developer of Binary Ninja at Vector 35. I also analyze malware and do security research in my free time.

My website