Lenovo Fingerprint USB Stick Sold as AES-256 Encrypted Held a Plain SD Card
A Lenovo fingerprint USB stick marketed as AES-256 encrypted contained a plain, unencrypted SD card inside, according to a Tom's Hardware report published on 1 November 2026.
The same report describes an AI-assisted follow-up that found a backdoor and hardcoded keys in other secure USB products. A hardcoded key is a cryptographic key built into firmware or silicon at the factory rather than generated for each device. Extracting it once can expose every unit that shares it, much like a single master key copied into every lock of the same model.
Lenovo's product listing for the Adesso Finger Print Reader USB-A Dongle states that the device uses 256-bit AES, a widely used symmetric cipher, to protect biometric data from unauthorized access. The listing describes encryption of the biometric data itself. A plain SD card inside the housing falls outside that description.
A second issue concerns authentication rather than storage. Lenovo's security advisory LEN-155804 reports an authentication bypass in Lenovo devices with Synaptics fingerprint readers, and the issue involves Windows Hello. Windows Hello is the biometric sign-in path many enterprise fleets now rely on. A bypass at that layer affects the trust decision made after the sensor reads a finger, not only the sensor itself.
Lenovo has paired fingerprint hardware with encryption before. In February 2011, Lenovo and WinMagic debuted SecureDoc for Lenovo, a full-disk encryption product with pre-boot support for fingerprint readers in select ThinkPad laptops and ThinkCentre desktops. That product sat in a different category from a retail USB dongle.
In my view, the question to ask of any encrypted peripheral is not whether the datasheet names AES-256, but where the keys live, who can read them, and what the sensor-to-host path actually protects. A hardcoded key turns one extraction into a fleet-wide exposure. An unencrypted storage medium fails more simply, and a physical inspection would reveal it. Neither failure depends on cipher strength, which is the part vendors tend to advertise. Both reward independent testing and public disclosure more than vendor assurance.
The broader context here is that fingerprint authentication and hardware-backed encryption are sound ideas when the cryptographic boundary can be checked from outside the vendor. Detailed findings published quickly are how the market learns which implementations meet that bar. The lesson from the Windows Hello advisory and the USB reporting is that the weakest point is often the integration between components, not the algorithm named on the box. That is a problem engineers can measure and fix.
