Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
Security researchers have disclosed new 'Plug and Pwn' attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges.
Intelligence analysis by Llama
Security researchers have found a way to exploit Windows' Plug and Play feature to install vulnerable software and gain SYSTEM privileges. This can be done with fake USB devices and no user interaction.
Imagine you plug a fake USB device into your computer, and it tricks Windows into installing bad software that lets hackers take control of your computer. This is called a Plug and Pwn attack, and it's a serious security risk.
Analysis
Plug and Pwn Attack Overview
The Plug and Pwn attack is a new type of attack that exploits the Windows Plug and Play feature to install vulnerable or insecure vendor software and gain SYSTEM privileges. This attack was presented at DEF CON 34 by security researchers Alejandro Hernando and Borja Martínez.
Abusing Windows Plug and Play
Windows supports a feature called co-installers, which automatically downloads and installs vendor software and drivers when a new USB device is inserted into a computer. In 2021, BleepingComputer reported on how this feature was abused along with a Razer Synapse vulnerability to give a standard Windows user SYSTEM privileges simply by plugging in a Razer mouse or keyboard.
The Research
The researchers used FaceDancer with Cynthion and GreatFET hardware connected to a small Linux computer to emulate USB devices. FaceDancer is a software framework for emulating USB devices, allowing researchers to define the descriptors, interfaces, device classes, and endpoints that a computer uses to identify connected devices.
The Attack Chain
The researchers demonstrated a zero-click physical attack that exploited behavior in Sierra Wireless and Sony FeliCa installation packages. The attack first impersonates a Sierra Wireless device, causing Windows to install software that can be abused to change the computer's DNS settings. The researchers then impersonate a Sony FeliCa device, which causes Windows to install additional Sony software that downloads files over an unencrypted connection.
Implications
The Plug and Pwn attack has significant implications for Windows users. It can be exploited to gain SYSTEM privileges, which is a significant security risk. The attack can be conducted with fake USB devices and no user interaction, making it a serious threat to Windows users.
Key points
- Security researchers have disclosed new 'Plug and Pwn' attacks that abuse the Windows Plug and Play feature to trigger Windows into installing vulnerable or insecure vendor software and gain SYSTEM privileges.
- The attack can be conducted with fake USB devices and no user interaction.
- The vulnerability affects Windows users and can be exploited to gain SYSTEM privileges, which is a significant security risk.
If this vulnerability is patched quickly, Windows users can rest assured that their systems are secure. Additionally, the research behind this attack can help improve the security of Windows and prevent similar vulnerabilities in the future.
If the vulnerability is not patched quickly, Windows users are at risk of being exploited by hackers. This could lead to significant security risks and potentially even data breaches.
