Security Researchers Uncover Vulnerabilities in Windows Plug and Play with “Plug & Pwn” Project
In a significant revelation, security researchers Alejandro Hernando, who operates under the alias 0xedh, and Borja Martínez have launched a research initiative termed “Plug & Pwn.” This project underscores a critical vulnerability within the Windows operating system, particularly concerning its Plug and Play (PnP) driver installation workflows. The research demonstrates how these workflows can be exploited to run vendor-supplied code with elevated NT AUTHORITY\SYSTEM privileges.
The findings were formally presented at DEF CON 34, a well-known cybersecurity conference, where the researchers delved into the precarious intersection of automatic driver retrieval, the utilization of signed vendor packages, USB device emulation, and vulnerable privileged components. Through this project, Hernando and Martínez broaden the understanding of how these interconnected components render systems susceptible to exploitation.
As part of their initiative, the researchers have made available proof-of-concept tools, source code, and demonstrations. These resources aim to assist cybersecurity defenders in reproducing and assessing the attack vectors that have been highlighted. In doing so, the researchers contribute a critical toolset for those seeking to fortify their defenses against such vulnerabilities.
Exploiting Windows PnP Drivers
The researchers clarify that the issue at hand is not limited to a solitary vulnerability within Windows. Instead, the demonstration illustrates how the operating system is capable of identifying newly connected devices, downloading their respective driver packages through Windows Update, and subsequently invoking installation components under SYSTEM privileges. This poses a serious threat, given that a local attacker can exploit this process without needing administrator rights, requiring only the presence of a logged-in user session or pre-installed vendor software.
The researchers illustrated the attack in a practical scenario termed “Plug & Pwn,” wherein a Linux system utilizing a FaceDancer device-emulation platform masquerades as specific USB hardware. In this scenario, the targeted system is a fully patched Windows 11 machine with no active user session. When the emulated device is recognized by the Windows operating system, it triggers the automatic installation of the appropriate vendor software.
The researchers articulated the specifics of the attack chain, which capitalizes on weaknesses within the Sierra Wireless and Sony FeliCa components. Notably, the Sierra service exposes a named pipe accessible to users, which allows them to modify the system’s DNS configuration. This vulnerability is exploited to reroute requests meant for Sony’s infrastructure to servers under the attacker’s control.
Furthermore, a co-installer for Sony FeliCa is initiated through the PnP workflow, which, according to the researchers, facilitates the download of configuration data using unencrypted HTTP. This process is further compounded by the insecure handling of data paths controlled by the attacker.
The findings indicate that this vulnerability not only allows for arbitrary file writing as SYSTEM but also enables a malicious DLL to be inserted into a privileged Windows directory. Repeating the emulation of the Sierra device subsequently leads to the loading of the planted DLL, thus resulting in SYSTEM-level code execution prior to user login.
The “NoPlug & Pwn” Scenario
Of particular concern is another variant identified by the researchers, dubbed “NoPlug & Pwn.” This scenario eliminates the need for physical USB access altogether. Instead, it exploits the Remote Desktop Protocol (RDP) USB redirection feature—a common element in virtual desktop infrastructure environments. This feature allows devices connected to a local machine to be accessed within a remote session; however, the researchers discovered a loophole whereby clients are able to present USB descriptors representative of devices that do not exist physically.
By employing a custom Python RDP client built upon the aardwolf library, the researchers could fabricate USB device descriptors over the URBDRC virtual channel. If PnP redirection is enabled on the RDP server, Windows accepts these fictitious hardware identities, triggering its standard driver-resolution process.
In their demonstration, the researchers utilized an Intel RealSense driver package. The package’s co-installer was found to execute commands at SYSTEM level from a user-writable directory. This flaw allowed standard users to introduce a malicious DLL in that directory, activating SYSTEM execution through the forged device installation.
Broader Implications and Recommendations
The insights from this research raise essential concerns regarding supply-chain security. Although code signing can attune users to the publisher and integrity of a package, it does not assure the security inherent in every service, installer, co-installer, registry operation, or auxiliary utility within said package.
The research team also unveiled an additional attack chain that intertwined the behavior of a Wacom service with a legacy Atheros privileged registry-write vulnerability. Through this pathway, a malicious Print Monitor DLL could be registered with SYSTEM privileges, enabling the Windows Print Spooler to load it, thereby activating a Wacom service path that results in an interactive SYSTEM command shell.
In light of these findings, cybersecurity professionals are urged to impose stricter controls on USB device installations, deactivate unnecessary RDP USB and PnP redirection, conduct comprehensive audits of vendor driver packages, and maintain vigilant monitoring of unforeseen driver installations. Organizations must also review privileged services that operate on files, registry values, named pipes, or network configurations sourced from locations accessible by non-administrative users, thereby mitigating potential vulnerabilities and enhancing overall system security.