Plug and Pwn Attacks Abuse Windows PnP and RDP USB Redirection for SYSTEM Access
Summary
Researchers demonstrated Plug and Pwn attacks that use emulated USB devices or RDP USB redirection to trigger Windows installation of vulnerable vendor packages and gain SYSTEM access, even on fully updated systems.
Key points
- Researchers Alejandro Hernando and Borja Martínez presented Plug and Pwn attacks at DEF CON 34, using emulated USB devices to make Windows install vendor packages with SYSTEM privileges.
- A physical attack chain impersonated Sierra Wireless and Sony FeliCa devices to alter DNS settings, redirect downloads, and place a malicious file on a fully updated Windows 11 system.
- A separate attack used RDP USB redirection to present fake Intel RealSense device descriptors to a remote host and exploit a co-installer through DLL hijacking.
- Some demonstrations required no user interaction or logged-in session; the RDP attack requires USB redirection to be enabled.
- The researchers also described a Wacom and Atheros package chain exploiting CVE-2019-10617 through an INF-installed driver service.
- DisableCoInstallers can disrupt some chains but does not block all Plug and Play installation paths; the researchers recommend device-installation restrictions and disabling unnecessary PnP redirection on RDP or VDI hosts.
Article Details
- Attack Vectors
- Emulated USB devices trigger Windows Plug and Play to install vendor packages and components with SYSTEM privileges.
- RDP USB redirection can deliver fabricated USB descriptors to a remote Windows host, triggering device installation and vulnerable vendor software.
- A demonstrated chain changes DNS settings, redirects Sony software downloads to an attacker-controlled server, and places a malicious file on the system.
- A Wacom and Atheros package chain exploits CVE-2019-10617 in an Atheros driver service installed through an INF file.
- Defensive Notes
- Enable the DisableCoInstallers registry value to prevent driver packages from executing co-installers; this disrupts some demonstrated chains but does not eliminate the attack surface.
- Use device installation restrictions or hardware-ID allow-lists on sensitive systems.
- Disable Plug and Play device redirection on RDP and VDI hosts that do not need it, using fDisablePNPRedir.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe demonstrated chains exploit weaknesses in vendor software or driver components to obtain SYSTEM privileges.T1105 · Ingress Tool TransferIn the Sony FeliCa chain, the researchers redirect software downloads to a server they control and deliver a malicious file to the system.T1200 · Hardware AdditionsResearchers physically connected emulated USB devices to trigger Windows device installation.T1574.001 · DLLThe Intel RealSense RDP demonstration abuses DLL hijacking in a Windows Update package co-installer to obtain SYSTEM privileges.
CVE
People
Alejandro HernandoSecurity researcher who presented the Plug and Pwn research and described its attack chains and defensive mitigations.Borja MartÃnezSecurity researcher who presented the Plug and Pwn research.Will DormannVulnerability analyst who warned about similar Plug and Play installation risks and recommended the DisableCoInstallers setting.
Vendors
AtherosThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.IntelThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.Sierra WirelessThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.SonyThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.WacomThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.
Products
Intel RealSenseThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.Microsoft WindowsResearchers unveiled “Plug and Pwn” attacks that abuse Windows Plug and Play and RDP USB redirection to force automatic installation of vulnerable vendor packages, enabling attackers to gain SYSTEM privileges.Sony FeliCaThe demonstrations used emulated USB devices and affected software from Sierra Wireless, Sony FeliCa, Intel RealSense, Wacom, and Atheros, showing that even fully updated Windows systems can be exposed.
Tools
CynthionThe researchers told BleepingComputer that they used FaceDancer with Cynthion and GreatFET hardware connected to a small Linux computer to emulate USB devices.FaceDancerResearchers used FaceDancer hardware to emulate USB devices and force driver matching.GreatFETThe researchers told BleepingComputer that they used FaceDancer with Cynthion and GreatFET hardware connected to a small Linux computer to emulate USB devices.