This USB Device Could Give Hackers Full Control of Your Windows PC in 5 Minutes

The seemingly innocuous USB gadget you just plugged in might actually be a cunning trap. A new class of attacks known as "Plug and Pwn" has been discovered by security researchers. These exploits take use of a fundamental Windows feature to obtain total SYSTEM-level control over a computer, frequently with no user input at all.

Researchers Alejandro Hernando and Borja Martínez demonstrated the technique at DEF CON 34. It takes advantage of the way Windows recognizes new hardware and installs vendor software with the highest system privileges. Attackers can fool Windows into downloading and running insecure vendor packages that can be exploited to take complete control of the system by imitating fictitious USB devices.

How a Fake USB Device Becomes a System Backdoor

When a USB device is plugged into a Windows computer, the operating system looks for and installs vendor software and compatible drivers. This program does not display the user account control (UAC) prompt and operates with SYSTEM rights, which are the greatest level of access on a Windows computer.

The researchers found that they could simulate USB devices using a program called FaceDancer, leading Windows to assume that a certain piece of hardware had been attached. They mimicked a Sierra Wireless device in their zero-click physical demonstration, which led Windows to install potentially dangerous software that may alter the DNS settings. Next, they installed extra software that downloads files over an unencrypted connection by simulating a Sony FeliCa device. They took advantage of a vulnerability to install a malicious file on the system with SYSTEM rights and redirected those downloads to a server under their control by manipulating the DNS settings. Windows loaded the malicious file and opened a reverse shell with complete SYSTEM access after they finally re-emulated the Sierra device.

When a fully updated Windows 11 PC is not logged in, the complete attack takes about five minutes.

No Hardware? No Problem: The RDP Variant

The "NoPlug & Pwn" version, which doesn't require any gear at all, might be more worrisome. RDP USB redirection, which enables USB devices connected to a local computer to be accessible from a remote Windows session, is abused in this attack. The researchers duped a remote Windows host into interpreting the fictitious USB descriptors as a genuine USB device by developing a Python RDP client that transmits phony USB descriptors over this redirection capability. They were able to exploit an Intel RealSense camera package by DLL hijacking in order to obtain SYSTEM rights because this initiated the same Plug and Play installation procedure.

Why This Matters for Your Organization

A basic flaw in Windows' device installation process is exposed by the Plug and Pwn attack. Co-installers, services, and drivers are all part of the privileged installation path, which functions without user supervision, giving attackers access to a vast attack surface.

Although some attack chains can be broken by turning on the DisableCoInstallers registry option, the fundamental risk is still present. As evidenced by their Wacom and Atheros attack chain, attackers can still take advantage of flaws in INF-installed services.

How Bayon Technologies Group Can Help

We at Bayon Technologies Group are aware that contemporary threats take use of the very characteristics intended to make computing convenient. We support organizations:

• Use hardware-ID allow-lists and device installation limitations to stop illegal USB devices from initiating the Plug and Play procedure.

• On systems that don't need it, turn off RDP USB redirection (fDisablePNPRedir).

• As part of a more comprehensive defense-in-depth approach, use the DisableCoInstallers registry option.

• Install endpoint detection and response (EDR) tools that can spot attempts at privilege escalation and suspicious driver installations.

To find and fix vulnerabilities in your Windows environment, conduct security assessments.

Avoid allowing a basic USB device to be the starting point for a whole system compromise. To create a defensive plan that shields your company from Plug and Pwn and related threats, get in touch with Bayon Technologies Group right now.