Plug and Pwn Attack: Fake USB Devices Hijack Windows Plug and Play for SYSTEM Privileges

Researchers have unveiled Plug and Pwn, a new class of attacks that abuses Windows Plug and Play to install vulnerable vendor software and gain SYSTEM privileges with little or no user interaction. First demonstrated at DEF CON 34, the attack works on fully patched Windows 11 systems. It can also be executed remotely over RDP without any physical hardware.

What Happened: Plug and Pwn Attack Hijacks Windows Plug and Play for SYSTEM Access

Security researchers Alejandro Hernando and Borja Martínez disclosed a new attack called Plug and Pwn at DEF CON 34. The technique exploits how Windows automatically identifies newly connected hardware, locates matching driver packages, and installs vendor software with SYSTEM privileges.

By using software to emulate USB devices, the researchers found they could force Windows to install signed vendor packages containing exploitable components. Some attack chains require no user interaction and no logged-in session. In one demonstration, the attack took roughly five minutes against a fully patched Windows 11 computer.

Technical Details of the Plug and Pwn Vulnerability

The attack targets the Windows co-installer feature, a built-in mechanism that downloads and installs vendor software and drivers when new USB hardware is detected. In 2021, a similar Razer Synapse flaw showed how an attacker could gain SYSTEM privileges just by plugging in a Razer mouse. Plug and Pwn belongs to the same family but focuses on the device installation path itself rather than a single vendor’s installer.

The researchers used FaceDancer, a software framework for emulating USB devices, with Cynthion and GreatFET hardware. They could make their hardware appear to Windows as specific USB devices, triggering the operating system to recognize the emulated hardware and install the associated vendor driver packages.

Attack Chain: Sierra Wireless and Sony FeliCa Zero-Click Exploit

In the zero-click physical demonstration, the researchers chained multiple impersonated devices:

1. Impersonate a Sierra Wireless device to cause Windows to install software that can change the computer’s DNS settings.
2. Impersonate a Sony FeliCa device to trigger installation of Sony software that downloads files over an unencrypted connection.
3. By controlling DNS, redirect Sony downloads to an attacker-controlled server.
4. Exploit a flaw in the Sony software to place a malicious file on the system with SYSTEM privileges.
5. Re-impersonate the Sierra device to load the malicious file and open a reverse shell with SYSTEM privileges.

NoPlug & Pwn: Remote RDP Attack Without Physical Hardware

The researchers also demonstrated NoPlug & Pwn, a remote variant that requires no physical USB device. This attack abuses RDP USB redirection, a feature that allows USB devices attached to a local computer to be available inside a remote Windows session.

Instead of redirecting a real device, the researchers created a Python RDP client that sends specific USB descriptors over the USB redirection feature. The remote Windows host treats the fake descriptors as a legitimate USB device, creates the corresponding Plug and Play device, and installs the associated drivers and vendor software as SYSTEM. In their demonstration, they impersonated an Intel RealSense camera whose Windows Update package contains a co-installer that can be abused through DLL hijacking.

Disabling Co-Installers Only Partially Mitigates the Attack

Windows administrators can enable the DisableCoInstallers registry value to prevent driver packages from executing co-installers during device installation. However, this does not eliminate the underlying attack surface. The researchers demonstrated another attack using Wacom and Atheros packages that exploits CVE-2019-10617 in an Atheros driver service installed through an INF file rather than a co-installer.

Hernando recommends pairing DisableCoInstallers with device installation restrictions, hardware-ID allow-lists, and disabling PnP device redirection on RDP and VDI hosts that do not need it (fDisablePNPRedir).

Business and Operational Impact

Plug and Pwn represents a significant threat to organizations that rely on Windows workstations, virtual desktops, and RDP-accessible servers. The implications are far-reaching:

• Physical security bypass: An attacker with brief physical access or a small embedded device can gain SYSTEM privileges in minutes, even on locked or unattended systems.
• Remote exploitation via RDP: The NoPlug & Pwn variant removes the physical-access requirement entirely, making the attack viable against any RDP-accessible system where USB redirection is enabled.
• Virtual desktop environments at risk: RDP USB redirection is common in VDI environments, expanding the attack surface to cloud workstations and remote-access infrastructure.
• No user interaction required: Several chains work with no logged-in user and no clicks, making detection difficult.
• Signed vendor software abused: The attack leverages legitimate, signed vendor packages, making signature-based detection ineffective.

Organizations with sensitive systems, critical infrastructure, and air-gapped environments face elevated risk. The portability of the attack hardware means that even brief, opportunistic access to a workstation or conference room PC could lead to full compromise.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Enable DisableCoInstallers: Set the DWORD-32 value DisableCoInstallers to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer.
2. Restrict device installations: Use Group Policy to restrict which hardware IDs can be installed. Maintain hardware-ID allow-lists for approved devices.
3. Disable RDP USB redirection: On RDP and VDI hosts that do not require it, disable PnP device redirection via the fDisablePNPRedir setting.
4. Monitor for suspicious PnP events: Log and alert on unusual device installation events, especially for devices not in the organization’s hardware inventory.
5. Audit co-installer execution: Review systems for vendor software that installs services or executables automatically through INF files.

Long-Term Hardening

Plug and Pwn is not a single vendor bug. It is a systemic weakness in how Windows handles hardware discovery and automatic software installation. Consequently, the most effective mitigation is a defense-in-depth approach combining device restrictions, network segmentation, and least-privilege principles. Organizations should also review whether automatic driver updates through Windows Update are necessary for all systems and consider disabling them on high-security workstations.

Incident Summary

Incident / Vulnerability:	Plug and Pwn Windows Plug and Play Privilege Escalation
Affected Systems:	Fully patched Windows 10, Windows 11, Windows Server; RDP/VDI environments
Disclosure Date:	August 2026 (DEF CON 34)
Patch Status:	N/A — underlying behavior is by design; mitigations available via registry/policy
Attack Vectors:	Physical USB emulation (FaceDancer), remote RDP USB redirection
Privileges Gained:	NT AUTHORITY\SYSTEM
User Interaction:	Zero-click for some chains; remote variant requires RDP access

References

1. Lawrence Abrams, “Plug and Pwn attack uses fake USB devices for Windows SYSTEM access,” BleepingComputer, August 12, 2026, https://www.bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/.
2. Bill Toulas, “Lazarus hackers exploited Windows zero-day to target defense firms,” BleepingComputer, August 12, 2026, https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/.
3. Microsoft, “Co-installer Operation,” Microsoft Learn, https://learn.microsoft.com/en-us/previous-versions/windows/drivers/install/co-installer-operation.
4. Great Scott Gadgets, “FaceDancer,” GitHub, https://github.com/greatscottgadgets/Facedancer.
5. Plug and Pwn Research, https://plugandpwn.com/.
6. Will Dormann, “DisableCoInstallers recommendation,” Mastodon, August 2026, https://infosec.exchange/@wdormann/117071610303857767.