● Covered by 2 sources · 2 reportsMedium impact2 negative
Researchers demonstrate 'Plug And Pwn' attack for Windows SYSTEM access via USB auto-install
Key points
- "Plug And Pwn" exploits Windows Plug and Play.
- Achieves SYSTEM-level code execution on Windows 11.
- Uses emulated USB devices to install vulnerable software.
- Can be triggered physically or remotely via RDP.
- Presented by Alejandro Hernando and Borja Martinez at DEF CON 34.
Windows PnP Abused for SYSTEM Access
Security researchers Alejandro Hernando and Borja Martinez have disclosed a new attack method, dubbed "Plug And Pwn," which leverages the Windows Plug and Play (PnP) feature to gain SYSTEM privileges on Windows 11. The technique was presented at DEF CON 34.
The attack exploits how Windows automatically identifies new hardware, locates matching driver packages, and installs vendor software, often as the NT AUTHORITY\SYSTEM account.
How the Attack Works
The researchers developed tooling to emulate arbitrary USB devices. By doing so, they can force Windows to install signed vendor packages that contain exploitable components or weaknesses. These vulnerabilities can then be abused to achieve SYSTEM-level code execution.
Microsoft's driver documentation describes the underlying selection process: Windows receives hardware and compatible IDs for a device and uses them to find a matching driver package. The "Plug And Pwn" attack manipulates this process.
Physical and Remote Attack Vectors
The attack can be initiated through a physical connection by emulating a USB device. For example, the researchers demonstrated emulating a Sierra Wireless device to install SwiService.exe, a SYSTEM service with a SetDNS primitive, which they then used to redirect DNS.
Additionally, the same PnP path can be triggered remotely over Remote Desktop (RDP) if supported Plug and Play or low-level USB redirection is enabled. While Microsoft states that redirection is not allowed by default, some demonstrated attacks require no user interaction or a logged-in user.
Impact and Context
This research highlights a method for an unprivileged user to escalate privileges to SYSTEM level by exploiting a core Windows feature. The ability to trigger this both physically and remotely under certain conditions presents a notable security concern.
The "Plug And Pwn" attacks build on the understanding of Windows' co-installer feature, which automatically downloads and installs vendor software and drivers when a new USB device is connected.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
Security researchers have revealed "Plug and Pwn" attacks that leverage the Windows Plug and Play feature to install vulnerable vendor software and achieve SYSTEM privileges. These attacks exploit how Windows automatically identifies new hardware and installs drivers, posing a risk for unauthorized system access.
Security researchers demonstrated a method to achieve SYSTEM-level code execution on Windows 11 by exploiting the Plug and Play (PnP) auto-installation process for USB devices. This technique, dubbed "Plug And Pwn," can be triggered both physically and remotely under specific conditions, allowing an unprivileged user to gain high-level access.