GoKawiilSecurity researchers have disclosed new "Plug and Pwn" attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges.
The research, presented at DEF CON 34 by security researchers Alejandro Hernando and Borja Martínez, exploits how Windows automatically identifies new connected hardware, locates matching driver packages, and installs vendor software as the NT AUTHORITY\SYSTEM account.
By using software to emulate USB devices, the researchers found they could force Windows to install signed vendor packages containing exploitable components or weaknesses that can be abused to gain SYSTEM privileges.
Some of the demonstrated attacks require no user interaction or logged-in user, while another can be performed remotely over RDP without any physical USB hardware being connected to the targeted computer. plugandpwn.com.
Abusing Windows Plug and Play
Windows supports a feature called co-installers, which automatically downloads and installs vendor software and drivers when a new USB device is inserted into a computer.
In 2021, BleepingComputer reported on how this feature was abused along with a Razer Synapse vulnerability to give a standard Windows user SYSTEM privileges simply by plugging in a Razer mouse or keyboard.
When a Razer device was connected, Windows automatically downloaded and launched the Razer Synapse installer with SYSTEM privileges. A flaw in the installer allowed a standard user to launch PowerShell from the installation interface, causing the shell to inherit the installer's privileges.
BleepingComputer tested the vulnerability at the time and confirmed that it could be used to gain SYSTEM privileges in approximately two minutes.
At the time, vulnerability analyst Will Dormann previously warned that similar vulnerabilities were likely present in other software automatically installed through Windows Plug and Play.
... continue reading