Thinkpad Owners Should Patch This Flaw Now
The flaw in Lenovo’s Fingerprint Manager Pro enabled attackers to log into devices running Windows 7, 8 and 8.1, and let anyone log into your PC with a hardcoded password, skipping the fingerprint reader altogether. Both would require physical access to your PC. “A vulnerability has been identified in Lenovo Fingerprint Manager Pro,” Lenovo wrote (opens in new tab) on its support page. “Sensitive data stored by Lenovo Fingerprint Manager Pro, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in....