Security researchers have disclosed a new family of attacks, dubbed "Plug and Pwn", which exploit the Windows Plug and Play feature to force the installation of vulnerable or insecure vendor software, enabling attackers to gain SYSTEM privileges on a targeted machine.
The research, presented at DEF CON 34 by security researchers Alejandro Hernando and Borja MartÃnez, outlines how Windows automatically identifies newly connected hardware, locates corresponding driver packages, and installs vendor software using the powerful NT AUTHORITY\SYSTEM account.
By employing software to emulate USB devices, the researchers demonstrated that they could compel Windows to install signed vendor packages containing exploitable components or weaknesses. These vulnerabilities can then be leveraged to escalate privileges to SYSTEM level.
Some of the attack methods showcased require no user interaction or a logged-in user, while another variant can be executed remotely over RDP without any physical USB hardware being connected to the target computer, as detailed on plugandpwn.com.
Windows incorporates a feature known as co-installers, which are designed to automatically download and install vendor software and drivers when a new USB device is inserted into a computer.
This functionality has been previously implicated in security vulnerabilities. In 2021, BleepingComputer reported on an instance where this feature was abused in conjunction with a Razer Synapse vulnerability. A standard Windows user was able to gain SYSTEM privileges simply by connecting a Razer mouse or keyboard.
Upon connection of a Razer device, Windows automatically downloaded and launched the Razer Synapse installer with SYSTEM privileges. A flaw within the installer allowed a standard user to initiate PowerShell from the installation interface, leading the shell to inherit the installer's elevated privileges. At the time, BleepingComputer verified that this vulnerability could grant SYSTEM privileges in approximately two minutes.
Vulnerability analyst Will Dormann had previously cautioned that similar vulnerabilities were likely to exist in other software automatically installed via Windows Plug and Play.
Hernando confirmed to BleepingComputer that Plug and Pwn belongs to the same family of attacks but clarifies that the new research delves deeper into the Windows device installation path itself.
"The Razer bug is the same family. The difference is that we went after the install path itself instead of one vendor's installer," Hernando stated to BleepingComputer. He added, "Some of our chains need no clicks and no logged-on session, and one of them runs over RDP with no hardware at all."
The core issue, according to the researchers, is that when Windows detects new hardware, it may automatically retrieve an associated signed package and execute vendor-supplied components as SYSTEM. This privileged installation path can encompass co-installers, services, support executables, and drivers, all without the operating system displaying a User Account Control (UAC) prompt.
To demonstrate their findings, the researchers told BleepingComputer they utilised FaceDancer, a software framework for emulating USB devices, in conjunction with Cynthion and GreatFET hardware connected to a small Linux computer. This setup allowed them to define the descriptors, interfaces, device classes, and endpoints that a computer uses to identify connected devices.
By connecting hardware running FaceDancer to a computer, the operating system could be made to behave as though a specific USB device had been plugged in. This enabled the researchers to make their hardware appear to Windows as particular USB devices, prompting the operating system to recognise the emulated hardware and proceed with locating and installing the corresponding vendor driver packages.
Certain attack chains also necessitated the emulated device to disconnect and then reappear with a different device identity.
"Several of our chains depend on presenting the device as composite so Windows loads usbccgp.sys and enumerates each interface on its own, which is what makes it match the vendor package instead of the inbox driver," Hernando explained to BleepingComputer. "We also need to re-enumerate on demand, dropping the device and coming back as a different identity."
In their zero-click physical demonstration, the researchers exploited behaviour in Sierra Wireless and Sony FeliCa installation packages. The attack sequence involved first impersonating a Sierra Wireless device, which caused Windows to install software that could be abused to alter the computer's DNS settings. Subsequently, they impersonated a Sony FeliCa device, leading Windows to install additional Sony software known to download files over an unencrypted connection.
By controlling the system's DNS settings, the researchers could redirect these downloads to a server under their control. They then exploited a flaw in the Sony software to place a malicious file onto the system with SYSTEM privileges. Finally, by re-impersonating the Sierra device, Windows was prompted to load the malicious file, allowing the attackers to open a reverse shell with SYSTEM privileges.
The researchers demonstrated this chain against a fully updated Windows 11 computer with no user logged in, stating that the entire attack takes approximately five minutes to complete.
When questioned about the portability of this attack, Hernando confirmed that their research hardware is already sufficiently portable. He also noted that a Raspberry Pi operating in USB gadget mode should theoretically be capable of performing this attack. However, he specified that the Flipper Zero device cannot currently execute FaceDancer attacks.
"Flipper Zero, no. There's no FaceDancer backend for it and the framework won't run on it," Hernando said. "Its BadUSB mode is fine for HID, but arbitrary composite descriptors and re-enumeration would be a firmware project."
The researchers also showcased an attack they termed "NoPlug & Pwn", which requires no physical hardware emulation. This method exploits RDP USB redirection, a feature that allows USB devices attached to a user's local computer to be available within a remote Windows session.
Instead of redirecting an actual device, the researchers developed a Python RDP client that transmits specific USB descriptors over this USB redirection feature during an RDP connection. The remote Windows host then treats these fake descriptors as a legitimate USB device connected to the guest computer, creating the corresponding Plug and Play device on the host. This, in turn, causes the relevant drivers and vendor software to be installed.
In their demonstration of this attack, they impersonated an Intel RealSense camera, whose Windows Update package contains a co-installer that can be exploited through DLL hijacking to acquire SYSTEM privileges.
"The server's USB hub driver enumerates our phantom device, and Windows PnP does exactly what it did in the physical demo: it matches the hardware ID and installs the driver, as SYSTEM," the researchers explained on the Plug and Pwn site.
This RDP attack is effective only on systems where USB redirection is enabled, a setting Hernando noted is common in virtual desktop environments.
To mitigate this type of attack, Will Dormann suggested that Windows administrators can enable the 'DisableCoInstallers' registry value. This setting prevents driver packages from executing co-installers during device installation.
To implement this, users can open the Registry Editor and navigate to the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer` Registry key. Under this key, a DWORD-32 value named `DisableCoInstallers` should be added and set to 1.
When BleepingComputer inquired whether this measure would effectively block Plug and Pwn, Hernando confirmed it would disrupt some of the demonstrated attacks, including the Sony FeliCa attack and the Intel RealSense RDP attack. However, he emphasised that it does not eliminate the underlying attack surface.
"It helps, and it would break parts of what we showed," Hernando told BleepingComputer. "It doesn't stop the class of attack, though. It leaves PnP enumeration, Windows Update resolution, driver staging, INF processing and INF-installed services untouched."
The researchers illustrated this point with another attack involving Wacom and Atheros packages. This particular method exploited a known vulnerability (CVE-2019-10617) in an Atheros driver service that is installed via an INF file, rather than through a co-installer.
For organisations managing sensitive systems, Hernando recommends implementing 'DisableCoInstallers' in conjunction with additional device blocking measures. "In anything sensitive I'd pair it with device installation restrictions or hardware-ID allow-lists, and turn off PnP device redirection on RDP and VDI hosts that don't need it (`fDisablePNPRedir`)," Hernando advised BleepingComputer.
The researchers have not reported all of the identified attack scenarios as new, standalone vulnerabilities to individual vendors. They note that many of these are not isolated security flaws but become exploitable only when combined with other system functionality.
