Security researchers Alejandro Hernando and Borja Martínez have unveiled a new class of "Plug and Pwn" attacks that leverage the Windows Plug and Play feature to achieve SYSTEM-level privileges. Presented at DEF CON 34, their research demonstrates how Windows' automatic hardware identification and driver installation process can be exploited to install vulnerable or insecure vendor software.
The core of the attack lies in Windows' behavior of automatically identifying newly connected hardware, locating corresponding driver packages, and installing associated vendor software with NT AUTHORITY\SYSTEM account privileges. By emulating USB devices through software, the researchers found they could compel Windows to install signed vendor packages containing components or weaknesses that could then be exploited to escalate privileges to SYSTEM. Some of the demonstrated attack chains require no user interaction or a logged-in user, while another can be executed remotely over RDP without any physical USB hardware connected to the target.
This research builds on a similar vulnerability reported in 2021, where a Razer Synapse flaw allowed a standard user to gain SYSTEM privileges by simply plugging in a Razer mouse or keyboard. In that instance, Windows automatically downloaded and launched the Razer Synapse installer with SYSTEM privileges, and a flaw in the installer allowed a standard user to launch PowerShell with inherited privileges. Hernando confirmed that Plug and Pwn belongs to the same family of attacks but focuses on the broader Windows device installation path rather than a specific vendor's installer.
The researchers utilized FaceDancer, a software framework for emulating USB devices, in conjunction with Cynthion and GreatFET hardware connected to a small Linux computer. FaceDancer allows researchers to define USB device descriptors, interfaces, device classes, and endpoints, making an operating system perceive the connected hardware as a specific USB device. This capability enabled them to trick Windows into recognizing emulated hardware and subsequently installing associated vendor driver packages. Some attack chains also necessitated the emulated device to disconnect and then reappear with a different device identity.
In a zero-click physical demonstration, the researchers exploited vulnerabilities in Sierra Wireless and Sony FeliCa installation packages. The attack began by impersonating a Sierra Wireless device, prompting Windows to install software that could be manipulated to alter the computer's DNS settings. Next, they impersonated a Sony FeliCa device, causing Windows to install Sony software that downloads files over an unencrypted connection. By controlling the system's DNS, the attackers redirected these downloads to a controlled server, exploiting a flaw in the Sony software to place a malicious file on the system with SYSTEM privileges. Finally, re-impersonating the Sierra device caused Windows to load the malicious file, establishing a reverse shell with SYSTEM privileges. This entire process, demonstrated on a fully updated Windows 11 computer with no user logged in, took approximately five minutes. The researchers stated that while a Flipper Zero device cannot currently execute these FaceDancer attacks, their research hardware is portable, and a Raspberry Pi in USB gadget mode could theoretically perform the attack.
The researchers also demonstrated a "NoPlug & Pwn" attack, which requires no physical hardware emulation. This attack abuses RDP USB redirection, a feature that makes local USB devices available within a remote Windows session. Instead of redirecting an actual device, the researchers developed a Python RDP client that sends specific USB descriptors over the RDP USB redirection feature. The remote Windows host then treats these fake descriptors as a legitimate USB device, creating a corresponding Plug and Play device on the host and triggering the installation of associated drivers and vendor software. Their demonstration involved impersonating an Intel RealSense camera, whose Windows Update package contains a co-installer vulnerable to DLL hijacking, leading to SYSTEM privileges. This RDP attack is effective on systems where USB redirection is enabled, a common configuration in virtual desktop environments.
While disabling the 'DisableCoInstallers' registry value (located at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer, by adding a DWORD-32 value named DisableCoInstallers and setting it to 1) can prevent driver packages from executing co-installers during device installation, Hernando noted that this only disrupts some of the demonstrated attacks, such as those involving Sony FeliCa and Intel RealSense. It does not eliminate the fundamental attack surface.
