Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

KUALA LUMPUR, 13 AUGUST 2026 —

Security researchers have disclosed new "Plug and Pwn" attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges. The research, presented at DEF CON 34 by security researchers Alejandro Hernando and Borja Martínez , exploits how Windows automatically identifies new connected hardware, locates matching driver packages, and installs vendor software as the NT AUTHORITY\SYSTEM account.

Windows supports a feature called co-installers , which automatically downloads and installs vendor software and drivers when a new USB device is inserted into a computer. In 2021, BleepingComputer reported on how this feature was abused along with a Razer Synapse vulnerability to give a standard Windows user SYSTEM privileges simply by plugging in a Razer mouse or keyboard.

When a Razer device was connected, Windows automatically downloaded and launched the Razer Synapse installer with SYSTEM privileges. A flaw in the installer allowed a standard user to launch PowerShell from the installation interface, causing the shell to inherit the installer's privileges. BleepingComputer tested the vulnerability at the time and confirmed that it could be used to gain SYSTEM privileges in approximately two minutes.

At the time, vulnerability analyst Will Dormann previously warned that similar vulnerabilities were likely present in other software automatically installed through Windows Plug and Play. Hernando told BleepingComputer that Plug and Pwn belongs to the same family of attacks, but the new research focuses more on the Windows device installation path itself. "The Razer bug is the same family.

The difference is that we went after the install path itself instead of one vendor's installer," Hernando told BleepingComputer. "Some of our chains need no clicks and no logged-on session, and one of them runs over RDP with no hardware at all." The researchers say the main issue is that when Windows detects new hardware, it may automatically retrieve an associated signed package and execute vendor-supplied components as SYSTEM.

This privileged installation path can include co-installers, services, support executables, and drivers, with no UAC prompt displayed by the operating system. The researchers told BleepingComputer that they used FaceDancer with Cynthion and GreatFET hardware connected to a small Linux computer to emulate USB devices. FaceDancer is a software framework for emulating USB devices, allowing researchers to define the descriptors, interfaces, device classes, and endpoints that a computer uses to identify connected devices.

Connecting hardware running FaceDancer to a computer can make the operating system behave as though a specific USB device had been plugged in. Using FaceDancer, the researchers could make their hardware appear to Windows as specific USB devices, causing the operating system to recognize the emulated hardware and locate and install the associated vendor driver packages. Some attack chains also require the emulated device to disconnect and then reappear as a different device identity.

"Several of our chains depend on presenting the device as composite so Windows loads usbccgp.sys and enumerates each interface on its own, which is what makes it match the vendor package instead of the inbox driver," Hernando explained to BleepingComputer. "We also need to re-enumerate on demand, dropping the device and coming back as a different identity." In their zero-click physical demonstration, the researchers exploited behavior in Sierra Wireless and Sony FeliCa installation packages.

The attack first impersonates a Sierra Wireless device, causing Windows to install software that can be abused to change the computer's DNS settings. The researchers then impersonate a Sony FeliCa device, which causes Windows to install additional Sony software that downloads files over an unencrypted connection.

By controlling the system's DNS settings, the researchers can redirect those downloads to a server they control and exploit a flaw in the Sony software to place a malicious file on the system with SYSTEM privileges. Finally, they impersonate the Sierra device again, causing Windows to load the malicious file and allow the attackers to open a reverse shell with SYSTEM privileges.

The researchers demonstrated this chain against a fully updated Windows 11 computer with nobody logged in, saying the complete attack takes approximately five minutes. When questioned if this attack can be conducted with small portable devices, Hernando said their research hardware is already portable enough to carry around and that a Raspberry Pi operating in USB gadget mode should theoretically be capable of conducting this attack as well.

However, he said the Flipper Zero cannot currently perform the FaceDancer attacks. "Flipper Zero, no. There's no FaceDancer backend for it and the framework won't run on it," Hernando said. "Its BadUSB mode is fine for HID, but arbitrary composite descriptors and re-enumeration would be a firmware project." The researchers also demonstrated what they call "NoPlug & Pwn," which requires no physical hardware emulation.

Instead, the attack abuses RDP USB redirection, a feature that allows USB devices attached to a user's local computer to be available inside a remote Windows session. Rather than redirecting an actual device, the researchers created a Python RDP client that sends specific USB descriptors over this USB redirection feature when connecting over RDP.

The remote Windows host then treats the fake descriptors as a legitimate USB device connected to the guest computer, creates the corresponding Plug and Play device on the host, causing the corresponding drivers and vendor software to be installed. In the researchers' demonstration, they impersonated an Intel RealSense camera whose Windows Update package contains a co-installer that can be abused through DLL hijacking to obtain SYSTEM privileges.

"The server's USB hub driver enumerates our phantom device, and Windows PnP does exactly what it did in the physical demo: it matches the hardware ID and installs the driver, as SYSTEM," the researchers explain… (AI-assisted rewrite, based on the original source)

Related: Microsoft · Alejandro Hernando