Security researchers have disclosed Plug and Pwn, a new attack technique that abuses Windows Plug and Play to install vulnerable vendor software and gain SYSTEM-level access. The attacks can use emulated USB devices, while one demonstration works remotely through RDP USB redirection without connecting physical hardware to the target.
Windows can install vendor software as SYSTEM
Windows Plug and Play automatically identifies new hardware, searches for matching drivers and installs vendor software when a device is connected. Parts of this installation process can run with NT AUTHORITY\SYSTEM privileges.
The researchers, Alejandro Hernando and Borja Martínez, found that an attacker can abuse this trusted process by making Windows believe that a particular USB device has been connected.
If Windows finds a matching signed driver package, it may install vendor-provided drivers, services, support tools or co-installers with SYSTEM privileges. This can create an escalation path if one of those components contains a vulnerability or unsafe behaviour.
The Plug and Pwn attack does not rely on a single vendor bug. Instead, it targets the wider Windows device-installation path and chains weaknesses in software packages that Windows installs automatically.
Fake USB hardware can trigger zero-click attacks
The researchers used FaceDancer, a framework that emulates USB devices through software. Their setup used FaceDancer-compatible hardware connected to a small Linux computer.
By defining a device’s USB descriptors, interfaces and endpoints, the equipment can appear to Windows as a real device from a selected vendor. Windows then identifies the emulated hardware and retrieves the related driver package.
Some attack chains require the fake device to disconnect and return using a different identity. This allows attackers to trigger several software installations in a specific sequence.
In one physical demonstration, the team combined weaknesses in Sierra Wireless and Sony FeliCa installation packages. The attack first impersonated a Sierra Wireless device, allowing the attackers to modify the targeted computer’s DNS settings.
It then impersonated a Sony FeliCa device. Windows installed Sony software that downloaded files through an unencrypted connection. The altered DNS settings redirected that download to an attacker-controlled server, allowing a malicious file to be placed on the system with SYSTEM privileges.
Finally, the fake Sierra device appeared again and triggered the loading of the malicious file. The researchers said the complete chain worked against a fully updated Windows 11 device with no logged-in user and took about five minutes.
NoPlug and Pwn abuses RDP USB redirection
The researchers also demonstrated a remote variation called NoPlug and Pwn. It does not require a physical USB device to be connected to the target computer.
Instead, it abuses RDP USB redirection, which allows USB devices connected to a local computer to be used inside a remote Windows session. The researchers created a Python RDP client that sends selected USB descriptors through this feature.
The remote Windows system then treats the descriptors as a legitimate connected device. Plug and Play creates the device, locates a matching package and installs the associated vendor software as SYSTEM.
In the demonstration, the researchers impersonated an Intel RealSense camera. Its Windows Update package included a co-installer that could be abused through DLL hijacking to gain SYSTEM privileges.
This version of the Plug and Pwn attack only works where RDP USB redirection is enabled. The researchers said this setting is common in virtual desktop infrastructure environments.
Disabling co-installers reduces some risks
Will Dormann recommended that administrators enable the DisableCoInstallers Windows registry setting. This prevents driver packages from running co-installers during device installation.
Hernando said this mitigation would block parts of the demonstrated attacks, including the Sony FeliCa chain and the Intel RealSense RDP attack. However, it does not remove the underlying attack surface.
Windows can still enumerate Plug and Play devices, resolve packages through Windows Update, stage drivers, process INF files and install services defined in driver packages.
The researchers also demonstrated an attack involving Wacom and Atheros packages. That chain exploited CVE-2019-10617 in an Atheros driver service installed through an INF file rather than a co-installer.
Organisations should limit device installation paths
The researchers recommend combining DisableCoInstallers with stricter device-installation controls on sensitive systems. Hardware-ID allow-lists and device-installation restrictions can prevent unapproved devices from triggering automatic software installation.
Organisations should also disable Plug and Play device redirection on RDP and VDI hosts where it is not required. Restricting USB redirection reduces the risk of remote attacks that emulate hardware through an RDP session.
The Plug and Pwn attack shows that trusted device-installation processes can become a privilege-escalation risk when they automatically run insecure vendor components with SYSTEM-level permissions.
0 responses to “Plug and Pwn attack uses fake USB devices for Windows SYSTEM access”