"Some of our chains need no clicks and no logged-on session, and one of them runs over RDP with no hardware at all."
That is how researcher Alejandro Hernando described the new "Plug and Pwn" class of attacks revealed at DEF CON 34 by Hernando and Borja Martínez. The pair demonstrated chains that cause Windows to retrieve and execute vendor-supplied software as the NT AUTHORITY\SYSTEM account by abusing the operating system's Plug and Play device-installation path.
How Plug and Pwn abuses Windows Plug and Play
Windows implements a device-installation path that identifies connected USB hardware, locates matching driver packages, and — when appropriate — installs vendor-supplied software and drivers. The researchers showed that this path can cause signed vendor packages to be executed by the operating system as SYSTEM, and that those packages may include co-installers, services, support executables or drivers that can be abused.
Plug and Pwn is not limited to traditional social-engineering or click-to-run installers. Some demonstrated chains require no user interaction and work with no logged-in user; at least one chain can be executed remotely over Microsoft Remote Desktop Protocol (RDP) without any physical USB hardware attached to the target.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadFrom fake USB devices to remote RDP attacks
Hernando and Martínez used hardware and software to emulate USB devices. They employed FaceDancer together with Cynthion and GreatFET hardware connected to a small Linux computer to present fake USB descriptors and force Windows to treat the emulated devices as legitimate hardware. FaceDancer lets researchers define descriptors, interfaces and endpoints so the target OS will enumerate a specified device identity.
The researchers’ zero-click physical chain impersonated multiple devices in sequence. First, emulating a Sierra Wireless device caused Windows to install software that could be abused to change DNS settings. Next, emulating a Sony FeliCa device caused Windows to install Sony software that downloaded files over an unencrypted connection. By controlling DNS, the researchers redirected those downloads to a server they controlled, exploited a flaw in the Sony software to place a malicious file on the system with SYSTEM privileges, then re-impersonated the Sierra device so Windows would load the malicious file and open a SYSTEM reverse shell. They demonstrated this against a fully updated Windows 11 machine with no one logged in; the researchers said the complete chain takes approximately five minutes.
Separately, the team demonstrated "NoPlug & Pwn": a remote attack that abuses RDP USB redirection. Instead of redirecting a physical device, they built a Python RDP client that sends crafted USB descriptors via the USB-redirection feature. The remote Windows host then enumerates the phantom device, matches hardware IDs and installs the driver package as SYSTEM. In the demo the researchers impersonated an Intel RealSense camera whose Windows Update package contains a co‑installer exploitable via DLL hijacking to obtain SYSTEM privileges. The RDP method only works on systems where USB redirection is enabled, which the researchers said is common in virtual desktop environments.
Tools, limits and notable specifics
- The researchers used FaceDancer with Cynthion and GreatFET hardware; they noted a Raspberry Pi in USB gadget mode should theoretically be capable of the attack. They said Flipper Zero cannot currently perform these FaceDancer-backed attacks because "there's no FaceDancer backend for it and the framework won't run on it."
- Several chains rely on presenting composite device descriptors so Windows loads usbccgp.sys and enumerates interfaces separately, which makes the platform choose vendor packages instead of inbox drivers; other chains require re‑enumeration (dropping and re-presenting the device) to change identity during the sequence.
- Not all exploit steps are single-vendor bugs. The researchers told BleepingComputer they have not reported all scenarios as new vulnerabilities because "many are not standalone security flaws and only become exploitable when combined with other functionality."
- The team illustrated additional chains that do not rely on co-installers, including an attack using Wacom and Atheros packages that exploits CVE-2019-10617 in an Atheros driver service installed through an INF file.
Mitigations, and their limits
Vulnerability analyst Will Dormann suggested administrators can enable the DisableCoInstallers registry value to prevent driver packages from executing co-installers during device installation. The registry change is made under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer by adding a DWORD-32 value named DisableCoInstallers and setting it to 1.
Hernando told BleepingComputer that disabling co-installers "would break parts of what we showed" — including the Sony FeliCa attack and the Intel RealSense RDP attack — but that it "doesn't stop the class of attack." He noted it leaves PnP enumeration, Windows Update resolution, driver staging, INF processing and INF-installed services intact. Hernando recommended that sensitive environments pair DisableCoInstallers with device installation restrictions or hardware‑ID allow-lists and to "turn off PnP device redirection on RDP and VDI hosts that don't need it (`fDisablePNPRedir`)."
What this means for technologists, administrators, and virtual desktop operators
- Technologists and security teams: expect that trusted, signed vendor packages executed by the SYSTEM account can become attack vectors when combined with permissive PnP behavior; some demonstrated chains require no logged-in user and can complete in minutes.
- Enterprise administrators and procurement leaders: consider pairing the DisableCoInstallers setting with device-installation restrictions or hardware-ID allow-lists and evaluate whether USB redirection is required for RDP/VDI hosts.
- Virtual desktop operators and RDP hosts: the NoPlug & Pwn demo specifically targets environments where USB redirection is enabled; operators should review the necessity of redirection and apply controls where feasible.
Plug and Pwn is not a single vendor flaw so much as a class of chains that leverage Windows’ trusted installation path to elevate privilege. The researchers have posted details at plugandpwn.com and demonstrated multiple practical sequences at DEF CON 34; administrators now face a familiar but awkward tradeoff — balancing device convenience against an installation path that runs with SYSTEM privileges.
