Tag: Patch Tuesday

Fake USB devices are now one of the most alarming vectors for gaining SYSTEM-level control over Windows machines — and the worst part is that victims don’t even need to click anything. Security researchers Alejandro Hernando and Borja Martínez publicly demonstrated a class of attacks, dubbed Plug and Pwn, that weaponise Windows’ own Plug and Play (PnP) subsystem to hand attackers the highest privilege tier on any targeted PC. If your organisation allows arbitrary USB hardware to connect to endpoints, this threat is immediate and real.

What Is the Plug and Pwn Attack?

The human factor makes this worse than it looks on paper. In a landmark study by researchers at the University of Illinois, the University of Michigan and Google, 297 USB drives were deliberately dropped around a university campus — and users picked up and connected an estimated 45–98% of them. Files were opened on 48% of the drives, and the first one was plugged into a machine within six minutes of being dropped. Applied to Plug and Pwn, that behaviour is all an attacker needs: no phishing email, no credential theft, just a device left in a car park or reception area.

The Plug and Pwn technique exploits a fundamental trust relationship built into Windows Plug and Play: when new hardware is detected, Windows automatically searches for and installs the appropriate driver — often fetching signed vendor software from the internet or from a local driver store. Researchers found that by presenting a carefully crafted fake USB device — one that masquerades as legitimate hardware — they could force Windows to load a malicious driver package and, in doing so, execute code at the SYSTEM level with zero user interaction required.

The attack does not rely on a traditional software vulnerability in the conventional sense. Instead, it abuses a design behaviour: Windows is engineered to be helpful and automatically install drivers, and that helpfulness becomes the exploit. The technique was presented publicly at DEF CON 34, along with proof-of-concept code, meaning the bar for replication by threat actors is now dramatically lower.

How a Malicious USB Attack Reaches SYSTEM Privileges

To understand why this USB privilege escalation is so dangerous, it helps to appreciate the Windows privilege model. Standard users operate at a restricted level. Administrators have elevated rights but are still constrained in many ways. SYSTEM is the highest local privilege tier — it is the account that Windows itself uses internally, and it can bypass most user-mode security controls, read sensitive credential stores, and interact with protected kernel objects.

Here is the step-by-step chain that the Plug and Pwn technique follows:

1. Physical or emulated connection. An attacker plugs in a crafted USB device — or, in remote scenarios, presents an emulated USB device over an RDP session — to the target machine.

2. PnP enumeration. Windows detects the device and begins its automatic hardware identification and driver-fetching routine.

3. Malicious driver injection. The fake device presents a device ID that matches a signed driver package pre-positioned in a reachable driver store or pulled down from the internet.

4. SYSTEM-level code execution. Because driver installation runs as SYSTEM, any code embedded or triggered in the driver package inherits that same privilege level — giving the attacker a SYSTEM shell on the endpoint.

The attack can succeed even when the user logged in at the time has only standard privileges. That is what makes the Plug and Pwn class of attacks so alarming from a threat-modelling perspective.

Who Is at Risk from This Fake USB Attack?

Any Windows endpoint that meets the following conditions is potentially vulnerable:

• USB ports are accessible and not disabled at the hardware or policy level.

• Automatic driver installation via Windows Update or the local driver store is enabled.

• The machine is reachable via RDP with external peripheral redirection permitted (for the remote variant).

• No endpoint detection solution actively monitors or blocks driver-store manipulation.

That description fits a significant proportion of corporate endpoints. The research highlights that Windows 10 and Windows 11 are both affected. Organisations in sectors with high physical-access risk — retail, healthcare, hospitality, co-working spaces, and open-plan offices — face an especially elevated threat level from a malicious USB attack of this type.

It is also worth noting that the RDP variant of Plug and Pwn expands the attack surface well beyond physical presence. An attacker who already has limited RDP access — perhaps through a phishing-obtained credential — could elevate themselves to SYSTEM without ever entering the building.

Plug and Pwn vs. Traditional BadUSB: What’s Different

You may be familiar with older USB-based attack tools such as BadUSB, Rubber Ducky, or OMG Cable, which typically emulate keyboards or network adapters to inject keystrokes or redirect traffic. Plug and Pwn is a distinct and, in some ways, more sophisticated category of USB privilege escalation because it does not depend on injecting keystrokes or tricking a user into running something.

The key difference: traditional BadUSB attacks still rely on the user’s session to execute payloads — they type commands as the logged-in user. Plug and Pwn, by contrast, exploits the SYSTEM-level driver installation process itself, entirely bypassing whatever the user’s permission level happens to be. This makes it effective even against hardened user accounts and even when application whitelisting is in force at the user level.

Immediate Steps IT Teams Should Take

The most effective mitigations combine policy controls, endpoint configuration, and physical security. None of these steps requires a Microsoft patch — they are defensive practices that should be in place regardless of this specific research.

1. Restrict USB Device Installation via Group Policy

Windows provides granular Group Policy controls under Computer Configuration > Policies > Administrative Templates > System > Device Installation > Device Installation Restrictions. Enabling “Prevent installation of devices not described by other policy settings” stops Windows from installing any unrecognised hardware automatically. You can then whitelist only approved device classes (e.g. approved keyboards and mice by vendor ID). This is the single most direct mitigation for fake USB devices attacking via PnP.

Microsoft’s own documentation on creating a GPO to disable USB storage devices provides a solid starting point, though for Plug and Pwn you will want to go further and restrict all unrecognised device classes, not just storage.

2. Disable Driver Installation from Windows Update for Endpoint Devices

One of the attack’s delivery mechanisms involves Windows fetching driver packages from Windows Update automatically. In enterprise environments, this behaviour can be suppressed via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates). Driver updates should be vetted and deployed through a managed endpoint solution instead.

3. Control RDP Peripheral Redirection

For the remote variant of the USB privilege escalation, disable Plug and Play device redirection in your Remote Desktop Session Host settings. In Group Policy, navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection and enable “Do not allow supported Plug and Play device redirection”. This closes the remote attack path.

4. Deploy Endpoint Detection and Response (EDR)

A quality EDR solution that monitors driver-store changes, unusual SYSTEM-level process spawns, and new hardware enumeration events will detect anomalous PnP activity even if policy controls are not fully hardened. Alert on any new driver installation from an unmanaged source, especially those that spawn child processes at SYSTEM privilege.

5. Apply Physical Security Controls

For endpoints in high-risk physical environments, consider USB port blockers (physical plugs that prevent insertion), epoxy fills for unused ports, or endpoint management policies that lock machines automatically after short idle periods. Physical access to a USB port is the prerequisite for the direct variant of this attack — removing that access removes the risk at source.

6. Keep Windows Fully Patched

While Plug and Pwn exploits a design behaviour rather than a specific named CVE patched in one update, running a fully updated Windows installation ensures that any related vulnerabilities — such as driver signing enforcement bypasses or PnP subsystem flaws — are closed as quickly as Microsoft addresses them. The BitLocker bypass exploit targeting Windows 11 demonstrated similarly that USB-adjacent attack surfaces can be patched, but only if your systems are up to date.

Why Signed Drivers Don’t Guarantee Safety

A common misconception is that Windows’ requirement for digitally signed drivers provides a safety net. It does raise the bar — but it does not close the Plug and Pwn gap entirely. Legitimate, signed driver packages that exist in the Windows Update catalogue or a corporate driver store can be abused if an attacker can steer Windows into installing them for a fake device. The signature validates the package’s origin and integrity, not its appropriateness for the connected hardware. This is why device installation restriction policies — not just signature enforcement — are the correct control.

The Broader Lesson: Windows Security Starts at the Perimeter

The Plug and Pwn research is a vivid reminder that perimeter-level thinking must extend to the physical layer. Network firewalls, strong passwords, and even BitLocker encryption do not protect against an attacker who can plug a malicious USB attack vector into an unguarded port and have Windows hand over SYSTEM privileges within seconds.

IT and security teams should treat any USB port on a corporate endpoint as a potential attack surface — because that is exactly what it is. Combine that mindset with the Group Policy and RDP controls outlined above, and you close the vast majority of the Plug and Pwn exposure without waiting for a vendor patch.

For organisations looking to maintain a locked-down, fully managed Windows estate, ensuring every machine runs a genuine, properly licensed copy of Windows is also foundational. A correctly licensed and activated Windows installation receives security updates reliably, without gaps or delays. You can explore Windows 11 Pro licences to keep your endpoints current and patch-ready — Windows 11 Pro also includes the most robust Group Policy toolset for implementing the device installation restrictions described above.

Frequently Asked Questions

What exactly are fake USB devices in the context of Plug and Pwn?

Fake USB devices are purpose-built or modified hardware units — or software-emulated virtual devices — that present a false hardware identity to Windows when connected. They mimic the device IDs of legitimate hardware to trigger Windows Plug and Play into installing a driver package chosen by the attacker. Unlike ordinary USB drives, they may carry no visible storage or function; their sole purpose is to manipulate the PnP subsystem.

Do I need to be physically present to carry out a USB privilege escalation attack?

Not necessarily. Researchers demonstrated a remote variant of the attack using USB device redirection over RDP. If an attacker has access to an RDP session — even with limited credentials — they can present a virtual fake USB device through that session and trigger the same SYSTEM-level driver installation chain. Disabling PnP device redirection in RDP settings is therefore a critical remote-attack mitigation.

Does Plug and Pwn affect Windows 11 specifically?

Yes. Both Windows 10 and Windows 11 are affected by the underlying Plug and Play design behaviour that the attack exploits. Windows 11 does introduce stricter hardware requirements and improved security defaults in some areas, but the PnP driver installation process that Plug and Pwn abuses is present and exploitable across both versions without specific hardening in place.

Will disabling USB ports protect against all malicious USB attacks?

Disabling or restricting USB ports removes the physical attack vector for the direct variant of Plug and Pwn, but it must be combined with RDP peripheral redirection controls to close the remote path. Additionally, disabling USB ports via Group Policy (device installation restrictions) is more granular and practical for most organisations than physically disabling ports, since it allows whitelisted devices like keyboards and mice to continue functioning.

Is there a Microsoft patch for this vulnerability?

Plug and Pwn exploits a design behaviour in Windows Plug and Play rather than a single discrete software bug with its own CVE in the traditional sense. Microsoft has acknowledged the research. Rather than waiting for a specific patch, organisations should implement the Group Policy restrictions, RDP controls, and endpoint hardening measures described in this article, which collectively mitigate the attack without depending on a single fix.

How does this relate to other USB-based Windows threats like BadUSB?

BadUSB-style attacks typically emulate keyboards or other human-interface devices to type commands in the context of the logged-in user. Plug and Pwn is distinct because it targets the SYSTEM-level driver installation process, bypassing user-level privilege entirely. The two attack classes can be used independently or in combination, but Plug and Pwn represents a more fundamental escalation path because it does not depend on user interaction or the user’s privilege level.