Plug and Pwn: Emulated USB Devices Force Windows to Install Vulnerable Software, Researchers Warn

Two security researchers have shown how Windows' automatic driver installation can be coerced into executing attacker-influenced vendor software with system-level privileges. Alejandro Hernando and Borja Martínez presented the 'Plug and Pwn' techniques at DEF CON 34, as reported by BleepingComputer.

The core problem is Windows Plug and Play. When a USB device connects, Windows identifies the hardware, matches it to a signed vendor package, and installs drivers and companion applications under the NT AUTHORITY\SYSTEM account. This process normally runs without a UAC prompt. The researchers used hardware and software that emulates USB devices—FaceDancer running on Cynthion or GreatFET boards attached to a Linux machine—to make Windows believe a specific peripheral was present. That triggered installation of vendor packages containing known weak components.

In one zero-click physical attack, the emulator first impersonated a Sierra Wireless device. Windows installed software that allowed the attacker to alter DNS. The emulator then switched to a Sony FeliCa identity, causing Windows to install Sony software that retrieves files over an unencrypted connection. With DNS control, the researchers redirected those downloads to a server they controlled and exploited a flaw to place a malicious file with SYSTEM privileges. Re-impersonating the Sierra device then loaded the file and opened a reverse shell. The whole chain worked on a fully updated Windows 11 machine with no user logged in and took about five minutes.

A remote variant, called 'NoPlug & Pwn,' avoids physical emulation entirely. It abuses RDP USB redirection, which lets local USB devices appear inside a remote session. The researchers wrote a Python RDP client that sends fake USB descriptors during connection. The remote Windows host treats those descriptors as a real device, runs Plug and Play, and installs the corresponding driver package. In the demo, they impersonated an Intel RealSense camera whose update package contains a co-installer vulnerable to DLL hijacking, again leading to SYSTEM access. This requires USB redirection to be enabled, which is common in virtual desktop environments.

Mitigation is limited. Security researcher Will Dormann had previously advised disabling co-installers via the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer with a DWORD value named DisableCoInstallers set to 1. Hernando told BleepingComputer that this breaks some of the demonstrated chains, including the Sony FeliCa and Intel RealSense attacks, but does not stop the broader class. The underlying path—PnP enumeration, Windows Update driver resolution, driver staging, INF processing, and INF-installed services—remains. A separate attack chain using Wacom and Atheros packages exploits CVE-2019-10617 in an INF-installed service, not a co-installer, so the registry setting would not help there.

For sensitive systems, Hernando recommends pairing DisableCoInstallers with device installation restrictions or hardware-ID allow-lists, and disabling PnP redirection on RDP and VDI hosts that don't need it. The researchers did not report every scenario as a new CVE because many are only exploitable when combined with other functionality.

The findings highlight that the privileged installation path for Plug and Play is a broad attack surface. Administrators should review USB device policies and RDP redirection settings even if they apply the co-installer block.