These drives received the U. S. Government's FIPS 140-2 certification based mainly on the fact that they use tough 256-bit AES encryption, and indeed the encryption itself is not at fault. Rather, the research team discovered that the actual encryption key used is not dependent on the password. The password-verification utility sends the same decryption string on receipt of a valid password, so they simply hacked it to always send that decryption string.

Score this one for the hackers ...