Open Menu
AllLocalCommunitiesAbout
lotide
AllLocalCommunitiesAbout
Login

Lenovo's 'encrypted' fingerprint USB drive is just an unencrypted SD card in a fancy case

⁨144⁩ ⁨likes⁩

Submitted ⁨⁨3⁩ ⁨days⁩ ago⁩ by ⁨floofloof@lemmy.ca⁩ to ⁨cybersecurity@infosec.pub⁩

https://www.tomshardware.com/tech-industry/cyber-security/lenovo-fingerprint-usb-stick-sold-as-aes-256-encrypted-had-a-plain-sd-card-inside-ai-assisted-follow-up-finds-a-backdoor-and-hardcoded-keys-in-other-secure-usb-products

source

Comments

Sort:hotnewtop
  • fonix232@fedia.io ⁨3⁩ ⁨days⁩ ago

    can we PLEASE stop linking stuff from shit-ass sites that use quasi-malware services like Ad-Shield (the service behind the notorious html-load(dot)com, error-report(dot)com etc.)?

    These sites intentionally break and block access when a DNS based ad blocker is used. Not because the site can't load - it actually loads perfectly fine behind the blockout - but because these fuckers intentionally unload CSS to break the site if ads won't load... via the same exact methods web malware loads malicious scripts.

    source
    • floofloof@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      I have some heavy DNS filtering and the site still loads fine in Vanadium on GrapheneOS. Many sites refuse to load in the way you describe and it is annoying, but I didn’t know this site was doing that.

      source
      • fonix232@fedia.io ⁨2⁩ ⁨days⁩ ago

        Interesting.

        I run my own AGH gateway at home with pretty heavy filtering, plus my iDevices have a NextDNS profile installed - and now most big tech sites do this crap...

        source
        • -> View More Comments
    • wyldrstallyns@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago

      Isn’t there a uB or *monkey script that nips those in the bud? 🤞🏼

      source
      • fonix232@fedia.io ⁨2⁩ ⁨days⁩ ago

        Neither of which are available on iOS in non-Safari browsers

        source
        • -> View More Comments
  • Triumph@fedia.io ⁨3⁩ ⁨days⁩ ago

    Wait wait - is it also advertised as a 1TB card that's configured to show 1TB of space when you plug it in, but then it's really just a 4GB card?

    source
    • Sturgist@piefed.ca ⁨3⁩ ⁨days⁩ ago

      it’s really just a 4MB card?

      source
  • MonkderVierte@lemmy.zip ⁨2⁩ ⁨days⁩ ago

    discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.

    What i always say; hardware-based encryption is not secure. It’s always between speed, security and cost, they go for speed and cost.

    source
  • degen@midwest.social ⁨3⁩ ⁨days⁩ ago

    an interim fix using epoxy over the card.

    Lmao encase that shit. Bro, we just need more physical security, trust me.

    source
  • CMDR_Horn@lemmy.world ⁨3⁩ ⁨days⁩ ago

    clearly a feature for when the sd card fails. think of how easy it will be to replace.

    source
    • Blibittyblah@futurology.today ⁨3⁩ ⁨days⁩ ago

      Poor marketing aside, I like it.

      source