Weaponizing Windows USB Auto-Install with Plug and Pwn
Simply connecting a mundane device to a computer can initiate a devastating sequence. Specifically, Windows itself might inadvertently download malicious components and execute them with maximum administrative rights. Security experts Alejandro Hernando and Borja Martinez dramatically demonstrated this at DEF CON 34. They unveiled the Plug and Pwn attack series, which ingeniously exploits the automatic device installation mechanism within Windows. Alarmingly, certain variations of this attack do not even require physical access to the target computer.
Exploiting the Plug and Play Mechanism
The core problem resides deeply within the ubiquitous Plug and Play mechanism. When a user connects a novel USB device, Windows meticulously identifies its hardware signatures. Subsequently, it searches for a compatible driver package and, if necessary, downloads it directly via Windows Update. Crucially, this installer executes under the immensely powerful SYSTEM account. Therefore, any supplementary manufacturer code bundled within that package also acquires extraordinarily high privileges, entirely bypassing User Account Control prompts.
Emulating Hardware Without Physical Devices
The researchers astutely discovered that a genuine physical device is not strictly necessary to trigger this process. They masterfully utilized the FaceDancer framework to perfectly emulate USB hardware, feeding Windows the precise identifiers of their chosen devices. The operating system naively accepted this forgery as authentic hardware, located the corresponding software, and automatically commenced installation. On a fully updated Windows 11 machine, this sophisticated demonstration concluded in approximately five minutes, culminating in arbitrary code execution with SYSTEM privileges, all without any user logging in.
Chaining Vulnerabilities for SYSTEM Access
The Sierra Wireless and Sony FeliCa Exploit Chain
In one intricate attack chain, the authors brilliantly combined vulnerabilities within Sierra Wireless and Sony FeliCa software. A specific Sierra component permitted the clandestine modification of the system’s DNS server. Subsequently, the Sony installer unwittingly downloaded its configuration over an unencrypted, interceptable HTTP connection. By manipulating these network addresses, the attackers successfully wrote a malicious DLL file directly into the protected System32 directory. Finally, simulating the Sierra device a second time coerced the system into executing that compromised file with SYSTEM privileges. Individually, these flaws posed a relatively minor threat; however, when chained together, they facilitated complete privilege escalation.
Remote Exploitation via NoPlug and Pwn
The Plug and Pwn methodology proves exceedingly dangerous even without physical access. The authors proactively developed a terrifying variant dubbed NoPlug and Pwn. This iteration maliciously leverages USB redirection through the standard Remote Desktop Protocol. The client transmits a description of the connected hardware to the server, which then virtually instantiates the device. The experts ingeniously learned to synthesize this description independently; therefore, a real USB device on the client side becomes entirely superfluous. This attack is highly viable in enterprise environments where administrators permit USB device redirection.
The Intel RealSense Remote Attack
To vividly demonstrate this remote capability, the specialists emulated an Intel RealSense camera. A standard, unprivileged user connected via Remote Desktop and transmitted data regarding the non-existent device to the server. Windows dutifully located the Microsoft-signed driver on Windows Update and installed it. An auxiliary component then launched a program from a user-accessible directory with SYSTEM privileges. The inherent intricacies of library searching allowed the attackers to substitute their own malicious DLL, seamlessly elevating their privileges.
Expanding the Attack Surface
Exploiting Wacom and Atheros Components
The authors systematically investigated other software packages that Windows might automatically install. Within Wacom software, they unearthed a service mechanism capable of launching a command prompt with SYSTEM privileges, contingent upon a specific registry value. While a standard user cannot modify this value, a legacy Atheros component, associated with a notorious 2019 vulnerability, shockingly permitted alterations to protected registry hives. Naturally, this Atheros package still installed flawlessly via the Plug and Play mechanism.
The Ultimate Privilege Escalation Demonstration
In their ultimate demonstration, the specialists masterfully combined the Wacom and Atheros flaws with the Windows print monitor mechanism. The Atheros component surreptitiously created the requisite entry within the protected registry section. Following a reboot, the print service unknowingly loaded the meticulously prepared DLL with SYSTEM privileges. Subsequently, this code activated the Wacom function, spawning an interactive SYSTEM command prompt. Strikingly, the attacker required absolutely no administrative rights, no genuine manufacturer hardware, and no custom vulnerable driver of their own.
The authors responsibly published the source code for their specialized tools alongside comprehensive demonstration materials, allowing independent verification of these alarming mechanisms.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
