Introduction to Plug and Pwn Attack
Security researchers Alejandro Hernando and Borja Martínez have presented a new attack called 'Plug and Pwn' at DEF CON 34, which exploits the Windows Plug and Play feature to gain SYSTEM privileges. This attack abuses the way Windows automatically identifies and installs vendor software for new connected hardware.
Abusing Windows Plug and Play
Windows supports a feature called co-installers, which automatically downloads and installs vendor software and drivers when a new USB device is inserted into a computer. In 2021, a similar vulnerability was reported, which allowed a standard Windows user to gain SYSTEM privileges by plugging in a Razer mouse or keyboard.
Hernando told BleepingComputer that the Plug and Pwn attack belongs to the same family of attacks, but the new research focuses more on the Windows device installation path itself. The researchers used software to emulate USB devices, forcing Windows to install signed vendor packages containing exploitable components or weaknesses that can be abused to gain SYSTEM privileges.
Attack Demonstration
The researchers demonstrated a zero-click physical attack, which exploited behavior in Sierra Wireless and Sony FeliCa installation packages. The attack first impersonates a Sierra Wireless device, causing Windows to install software that can be abused to change the computer's DNS settings. Then, it impersonates a Sony FeliCa device, which causes Windows to install additional Sony software that downloads files over an unencrypted connection.
By controlling the system's DNS settings, the researchers can redirect those downloads to a server they control and exploit a flaw in the Sony software to place a malicious file on the system with SYSTEM privileges. Finally, they impersonate the Sierra device again, causing Windows to load the malicious file and allow the attackers to open a reverse shell with SYSTEM privileges.
Remote RDP Attack
The researchers also demonstrated a remote RDP attack, which abuses RDP USB redirection, a feature that allows USB devices attached to a user's local computer to be available inside a remote Windows session. Instead of redirecting an actual device, the researchers created a Python RDP client that sends specific USB descriptors over this USB redirection feature when connecting over RDP.
The remote Windows host then treats the fake descriptors as a legitimate USB device connected to the guest computer, creates the corresponding Plug and Play device on the host, causing the corresponding drivers and vendor software to be installed. In the researchers' demonstration, they impersonated an Intel RealSense camera whose Windows Update package contains a co-installer that can be abused through DLL hijacking to obtain SYSTEM privileges.
Mitigation and Prevention
Will Dormann suggested that Windows administrators concerned about this type of attack can enable the 'DisableCoInstallers' registry value, which prevents driver packages from executing co-installers during device installation. However, Hernando said it would disrupt some of the demonstrated attacks but does not eliminate the underlying attack surface.
Hernando recommends that organizations with sensitive systems use 'DisableCoInstallers' along with additional device blocking. He also suggests turning off PnP device redirection on RDP and VDI hosts that don't need it.
- The researchers have not reported all of the attack scenarios as new vulnerabilities to individual vendors, saying that many are not standalone security flaws and only become exploitable when combined with other functionality.
- Once attackers have valid credentials, only 37% of their actions are blocked, according to The Blue Report 2026.
Source: BleepingComputer