Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
Plug and Pwn attack abuses Windows Plug and Play to gain SYSTEM privileges via fake USB devices.
Security researchers have unveiled the 'Plug and Pwn' attack, which exploits Windows' Plug and Play feature to install vulnerable vendor software with SYSTEM privileges. By emulating USB devices, attackers can trick Windows into installing signed packages containing exploitable components, leading to elevated access. Some variations require no user interaction or even a logged-in session, and one can be performed remotely over RDP without physical hardware.
AI summary of the linked source. Not reviewed by an editor. How this works
Run FaceDancer?
Get an email when a new story names FaceDancer, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe 'Plug and Pwn' attack abuses Windows' built-in Plug and Play mechanism, which automatically installs vendor-signed driver packages — some of which contain exploitable components — without sufficient privilege controls. Because Windows trusts signed packages implicitly, attackers can emulate USB devices or leverage RDP to trigger installations that escalate privileges to SYSTEM level, requiring little to no user interaction. This matters because SYSTEM access represents the highest privilege tier on a Windows host, enabling full compromise without ever exploiting a traditional vulnerability in Windows itself. The attack highlights how trusted automation features and implicit trust in signed software can become a significant attack surface when not properly governed.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- mitre_attack — T1071.001
- mitre_attack — T1200
- mitre_attack — T1068