New ‘Plug and Pwn’ attacks exploit Windows Plug and Play for SYSTEM privileges

Bleeping Computer reports that new "Plug and Pwn" attacks have been disclosed, which leverage the Windows Plug and Play feature to trick the operating system into installing vulnerable vendor software and ultimately grant attackers SYSTEM privileges.

Security researchers Alejandro Hernando and Borja Martínez demonstrated attacks at DEF CON 34 that exploit Windows' automatic hardware identification and driver installation process. By emulating USB devices, attackers can force Windows to install signed vendor packages containing exploitable weaknesses. Some attacks require no user interaction or even a logged-in session, while others can be performed remotely over RDP without physical hardware. The researchers used a framework called FaceDancer to emulate devices, leading Windows to install software that could be abused to alter DNS settings or download malicious files. One zero-click attack chain, demonstrated on Windows 11, takes about five minutes.

A remote variant, "NoPlug & Pwn," abuses RDP USB redirection to trick the host system into installing vulnerable vendor software. While disabling co-installers can mitigate some attacks, it does not address the underlying vulnerability in the Plug and Play mechanism. Organizations are advised to combine this with device installation restrictions and disable RDP PnP redirection where unnecessary.

Source: Bleeping Computer