Windows users are at risk of being exploited through a new class of attacks dubbed “Plug and Pwn,” where fake USB devices can be used to gain SYSTEM privileges on compromised machines. This disturbing trend highlights how even seemingly innocuous features in operating systems can be abused by malicious actors.
Security researchers Alejandro Hernando and Borja MartÃnez, who presented their findings at DEF CON 34, have demonstrated that Windows’ Plug and Play feature can be manipulated to install vulnerable or insecure vendor software, effectively granting attackers SYSTEM privileges. This is made possible because Windows automatically identifies new connected hardware, locates matching driver packages, and installs vendor software as the NT AUTHORITY\SYSTEM account.
The attack works by using software to emulate USB devices, which tricks Windows into installing signed vendor packages containing exploitable components or weaknesses that can be abused to gain SYSTEM privileges. The researchers used FaceDancer with Cynthion and GreatFET hardware connected to a small Linux computer to emulate USB devices, making their hardware appear to Windows as specific USB devices.
The Plug and Pwn attacks are particularly concerning because some of the demonstrated chains require no user interaction or logged-in user, while another can be performed remotely over RDP without any physical USB hardware being connected to the targeted computer. This means that even a compromised machine with no users logged in can still be exploited through remote access.
The researchers’ findings build upon previous research into the Plug and Play feature, which was abused along with a Razer Synapse vulnerability in 2021 to give a standard Windows user SYSTEM privileges simply by plugging in a Razer mouse or keyboard. The new research focuses more on the Windows device installation path itself, making it clear that this is not an isolated issue.
The main issue here is that when Windows detects new hardware, it may automatically retrieve an associated signed package and execute vendor-supplied components as SYSTEM. This privileged installation path can include co-installers, services, support executables, and drivers, with no UAC prompt displayed by the operating system. As Hernando explained to BleepingComputer, “The Razer bug is the same family, but we went after the install path itself instead of one vendor’s installer.”
The Plug and Pwn attacks are a sobering reminder that even seemingly secure systems can be vulnerable to exploitation through clever manipulation of their features. To protect against such attacks, it’s essential for users to be cautious when connecting unknown USB devices to their machines and to ensure that their operating system and software are up-to-date with the latest security patches.
In light of these findings, organizations should review their security protocols to ensure they account for the potential risks posed by Plug and Pwn attacks. This includes implementing strict access controls, monitoring user behavior, and regularly updating systems to prevent exploitation. By being aware of these types of threats, we can take proactive steps to safeguard our digital assets and protect against the ever-evolving landscape of cyber threats.
Source: Bleeping Computer — 2026-08-12