Plug and Pwn: Windows will go fetch a vendor installer and run it as SYSTEM, no device required

Alejandro Hernando and Borja Martinez presented research at DEF CON 34 showing that Windows Plug and Play can be pushed into locating a signed vendor driver package and executing its components as NT AUTHORITY\SYSTEM ^[2][1][3]. Some of the demonstrated chains need no user interaction and no logged-in user, and one of them runs remotely over RDP with no physical USB hardware connected to the target ^[5]. That last variant is the one to re-read, because USB controls in most estates are written on the assumption that the attacker has to reach the machine ^[1].

The mechanism is a documented Windows convenience. Co-installers automatically download and install vendor software and drivers when a new USB device is inserted ^[7]. The researchers say the problem is the path rather than any single product: when Windows detects new hardware it may retrieve an associated signed package and run vendor-supplied co-installers, services, support executables and drivers as SYSTEM, with no UAC prompt shown ^[1][8].

There is precedent. In 2021, BleepingComputer reported that plugging in a Razer mouse or keyboard caused Windows to download and launch the Razer Synapse installer as SYSTEM, and a flaw in that installer let a standard user spawn PowerShell that inherited the privileges ^[9][10]; BleepingComputer tested it and reached SYSTEM in about two minutes ^[11]. Vulnerability analyst Will Dormann warned at the time that similar issues were likely in other software installed automatically through Plug and Play ^[12]. Hernando told BleepingComputer that Plug and Pwn is "the same family," and that "the difference is that we went after the install path itself instead of one vendor's installer" ^[13].

The physical version of the attack is built from software-emulated devices. The researchers used FaceDancer with Cynthion and GreatFET hardware attached to a small Linux computer ^[15]. FaceDancer lets a researcher define the descriptors, interfaces, device classes and endpoints Windows uses to identify a device ^[16], so the rig can present itself as whatever product will pull down the wanted package ^[4]. Two details do the heavy lifting: presenting as a composite device so Windows loads usbccgp.sys and enumerates each interface separately, which makes it match the vendor package rather than the inbox driver, and dropping the device to re-enumerate under a different identity on demand, according to Hernando ^[18][17].

Their zero-click physical demonstration chains two vendors ^[19]. It first impersonates a Sierra Wireless device, causing Windows to install software that can be abused to change the machine's DNS settings ^[20], then impersonates a Sony FeliCa device, which brings down Sony software that fetches files over an unencrypted connection ^[21]. The account supplied to us stops mid-sentence at "By controlling the system's DNS settings" ^[22].

What is missing matters for triage. The material at hand carries no Microsoft or vendor response, no CVE identifiers, no patch status, and no explanation of how the RDP-only chain reaches the device installation path without hardware ^[23]. Until those exist, the defensible reading is that device installation is a privileged software distribution channel that fires without a prompt and without a session ^[8][5], and that the research site plugandpwn.com is where the specifics will appear ^[6].