Windows Plug and Play Vulnerabilities Allow SYSTEM Access via Fake USB Devices
A new wave of attacks has emerged, leveraging the Windows Plug and Play feature to compromise system security. Researchers Alejandro Hernando and Borja MartÃnez have revealed a family of “Plug and Pwn” attacks that exploit how Windows automatically identifies and installs software from connected hardware.
The vulnerability stems from Windows’ ability to detect and install vendor software when new hardware is connected, often without requiring user interaction or even a logged-in user. The operating system uses this feature, known as co-installers, to download and install signed packages containing drivers and support executables with SYSTEM privileges. This means that an attacker can bypass security measures by exploiting vulnerabilities in these installed components.
The research, presented at DEF CON 34, demonstrates how attackers can use software to emulate USB devices and force Windows to install vulnerable or insecure vendor software. By doing so, they gain access to the system’s inner workings with elevated privileges. The attacks are concerning because some require no user interaction, while others can be performed remotely over RDP without physical hardware being connected.
One of the most striking aspects of these attacks is their reliance on Windows’ Plug and Play feature. This functionality allows vendors to automatically download and install software when a device is plugged in, with SYSTEM privileges. The researchers noted that this behavior is not limited to specific devices or vendors, but rather it’s a fundamental aspect of how Windows handles connected hardware.
The team used FaceDancer, a software framework for emulating USB devices, to create fake USB connections and demonstrate the attacks. They achieved this by connecting their hardware running FaceDancer to a computer, making Windows behave as though a specific device had been plugged in. By manipulating the operating system’s recognition of connected devices, they could force it to install associated vendor driver packages containing exploitable components or weaknesses.
One attack chain involves impersonating a Sierra Wireless device, causing Windows to install software that can be abused to change DNS settings. Another exploits behavior in Sony FeliCa installation packages, allowing attackers to gain SYSTEM privileges and compromise system security.
The researchers emphasize that the main issue lies in how Windows handles new hardware connections and installs associated vendor software without displaying a UAC prompt. This privileged installation path includes co-installers, services, support executables, and drivers, making it an attractive target for attackers seeking elevated access.
To protect against these attacks, users should be cautious when connecting unknown devices to their computers. Vendors are also encouraged to review their driver packages and ensure they do not contain exploitable vulnerabilities. Furthermore, Windows administrators can configure their systems to require user approval before installing software from connected hardware.
In summary, the Plug and Pwn attacks highlight a critical vulnerability in how Windows handles connected hardware. By exploiting this weakness, attackers can gain SYSTEM privileges and compromise system security with relative ease. As researchers continue to uncover more vulnerabilities in this area, it’s essential for users to remain vigilant and take proactive measures to safeguard their systems against these types of threats.
Source: Bleeping Computer — 2026-08-12