Windows Plug and Pwn Attacks Can Exploit USB Device Installations to Gain SYSTEM Privileges

Security researchers have uncovered a new class of attacks called “Plug and Pwn,” which abuses Windows Plug and Play to trick the operating system into installing vulnerable or insecure vendor software. Successful attacks can allow threat actors to obtain Windows SYSTEM privileges.

The research was presented at DEF CON 34 by security researchers Alejandro Hernando and Borja Martinez. The attacks target the way Windows automatically detects newly connected hardware, identifies matching driver packages, and installs vendor software under the highly privileged NT AUTHORITY\SYSTEM account.

The researchers found that hardware capable of emulating a USB device can impersonate legitimate products and cause Windows to install signed vendor packages containing vulnerable drivers, services, or supporting applications.

Some Plug and Pwn attack chains require no user interaction or login. Others can be launched remotely through Remote Desktop Protocol (RDP), even when the target system has no physical USB hardware attached. Additional research details are available at plugandpwn.com.

How Plug and Pwn Exploits Windows Plug and Play

Windows uses Plug and Play to automatically detect hardware and install the required drivers and vendor software. These installation packages may include co-installers, services, executables, and drivers that run during device setup.

In 2021, BleepingComputer reported that this installation process could be abused alongside a vulnerability in Razer Synapse to grant SYSTEM privileges to standard Windows users. Simply connecting a Razer mouse or keyboard caused Windows to download and launch the Razer Synapse installer with SYSTEM privileges.

A flaw in the installer allowed a standard user to launch PowerShell from the installation interface. The resulting shell inherited the installer’s elevated privileges. BleepingComputer tested the vulnerability at the time and found that SYSTEM access could be obtained in approximately two minutes.

Vulnerability analyst Will Dormann previously warned that similar security weaknesses could exist in other software automatically installed through Windows Plug and Play.

Hernando told BleepingComputer that Plug and Pwn belongs to the same general attack family as the Razer vulnerability, but the new research focuses on the installation path itself rather than a single vendor’s installer.

“Razer’s bug is in the same vein. The difference is that they went after the installation path itself instead of one vendor’s installer,” Hernando told BleepingComputer.

“Some of our chains don’t require any clicks or logon sessions; one of them runs over RDP without any hardware at all.”

The primary security concern is that Windows automatically retrieves signed driver packages when it detects new hardware. During installation, Windows may execute vendor-provided components with SYSTEM-level privileges without displaying a User Account Control (UAC) prompt.

Fake USB Devices Can Trigger Vendor Software Installation

For their demonstrations, the researchers used FaceDancer, along with Cynthion and GreatFET hardware connected to a small Linux computer, to emulate USB devices.

FaceDancer is a software framework that allows researchers to emulate USB hardware by defining the descriptors, interfaces, device classes, and endpoints that computers use to identify connected devices.

When FaceDancer hardware is connected to a Windows computer, the operating system can interpret it as one or more legitimate USB devices. Windows then identifies the emulated hardware and searches for matching driver and vendor software packages.

Some attack chains require the device to disconnect and reappear with a different identity. This process, known as re-enumeration, causes Windows to load additional packages associated with the new hardware identity.

“Some of our chains rely on presenting devices as composites, so Windows loads usbccgp.sys and enumerates each interface on its own. This ensures that it matches vendor packages rather than inbox drivers,” Hernando explained to BleepingComputer.

“You also have to re-enumerate on demand, drop the device, and bring it back as a different identity.”

Sierra Wireless and Sony FeliCa Attack Chain

The researchers demonstrated a zero-click attack chain involving installation packages associated with Sierra Wireless and Sony FeliCa devices.

First, the attacker impersonates a Sierra Wireless device and causes Windows to install software that can be abused to change the computer’s DNS settings.

The attacker then impersonates a Sony FeliCa device. Windows installs additional Sony software and downloads files over an unencrypted connection.

After controlling the system’s DNS settings, an attacker can redirect those downloads to servers under their control. The attacker can then exploit flaws in the Sony software to place malicious files on the Windows system with SYSTEM privileges.

Finally, the attacker impersonates the Sierra Wireless device again and forces Windows to load a malicious file. This gives the attacker the ability to open a reverse shell with SYSTEM privileges.

The researchers demonstrated the attack against a fully updated Windows 11 computer with no user logged in. According to the researchers, the complete attack took approximately five minutes.

Hernando said the research hardware is already portable enough to be used in real-world scenarios. In theory, a Raspberry Pi operating in USB gadget mode could also be used to perform similar attacks.

However, Flipper Zero cannot currently perform the FaceDancer attack because it does not include a FaceDancer backend.

“Flipper Zero is different. It doesn’t have a FaceDancer backend, so the framework won’t work,” Hernando said.

“BadUSB mode is fine for HID, but any compound descriptor and re-enumeration becomes a firmware project.”

Remote Plug and Pwn Attacks Through RDP

The researchers also demonstrated an attack called “NoPlug & Pwn,” which does not require physical USB hardware.

This technique abuses RDP USB redirection, a feature that allows USB devices connected to a user’s local computer to be made available inside a remote Windows session.

The researchers created a Python-based RDP client that sends a specially crafted USB descriptor through the redirection channel instead of redirecting a real physical device.

The remote Windows system treats the descriptor as a legitimate USB device. It then creates a corresponding Plug and Play device and installs the associated driver and vendor software.

In their demonstration, the researchers impersonated an Intel RealSense camera. The Windows Update package for the camera contains a co-installer that can be exploited through DLL hijacking to obtain SYSTEM privileges.

“The server’s USB hub driver enumerates the phantom device, and Windows PnP does exactly what it did in the physical demo: matches the hardware ID and installs the driver as SYSTEM,” the researchers explained on the Plug and Pwn website.

RDP-based attacks require USB redirection to be enabled. Hernando said the feature is commonly enabled in virtual desktop infrastructure and other remote-access environments.

Disabling Co-Installers Reduces Risk but Does Not Stop Plug and Pwn

Will Dormann recommended that Windows administrators enable the DisableCoInstallers registry value to prevent driver packages from running co-installers during device installation.

To configure this setting, open Registry Editor and navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer

Create a 32-bit DWORD value named DisableCoInstallers and set its value to 1.

Hernando said this mitigation would block some demonstrated attack chains, including the Sony FeliCa attack and the Intel RealSense RDP attack. However, it does not eliminate the broader Plug and Play attack surface.

“It would help, but it would break some of what we showed,” Hernando told BleepingComputer.

“However, this type of attack is not prevented; PnP enumeration, Windows Update resolution, driver staging, INF processing, and INF-installed services remain intact.”

The researchers demonstrated this limitation with another attack involving Wacom and Atheros packages. The attack used CVE-2019-10617 in an Atheros driver service installed through an INF file rather than a co-installer.

Hernando recommends combining DisableCoInstallers with additional device installation restrictions, especially on sensitive systems.

“For sensitive ones, disable PnP device redirection (fDisablePNPRedir) on RDP and VDI hosts where it is not needed, in combination with device installation restrictions and hardware ID allowlists,” Hernando told BleepingComputer.

The researchers noted that not every Plug and Pwn attack scenario has been reported as a new vulnerability to individual vendors. Many of the attack chains are not standalone flaws and require multiple Windows features, driver packages, and vendor software weaknesses to be combined.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report