Quick Takeaways
- Attackers can exploit Windows Plug and Play (PnP) to remotely execute SYSTEM-level code by emulating USB devices, bypassing physical hardware requirements.
- Remote Desktop and USB redirection are vulnerable to this technique if enabled, allowing unprivileged users to leverage fake devices for privilege escalation.
- The attack involves placing malicious DLLs in system directories through path traversal, enabling low-privilege code to gain SYSTEM privileges on fully patched Windows 11 systems.
Threat, Attack Techniques, and Targets
Researchers have found a way to turn USB auto-installation into a full system takeover on Windows 11. They exploited the Windows Plug and Play (PnP) feature, which normally helps hardware devices install drivers. The attackers can emulate USB devices and trigger the installation process remotely via Remote Desktop or physically. They build tools to fake devices like Sierra Wireless, Sony FeliCa readers, and Intel RealSense, which then load malicious code. The process involves installing a driver, which can be manipulated to run a DLL file with SYSTEM privileges. This leads to complete control over the system. The targeted systems include fully updated Windows 11 PCs, where the attack chain is demonstrated successfully.
Impact, Security Implications, and Remediation Guidance
This vulnerability is serious because it allows an attacker with access to present fake USB devices and gain SYSTEM access. They can bypass typical security measures, especially if USB redirection is enabled over remote connections. This can lead to high privilege privileges, data theft, or system control. Microsoft states that redirection features are off by default, and administrators can disable USB redirection and restrict device installation by hardware ID or other policies. For complete security measures and guidance, organizations should consult the official vendor or security authority. They should ensure settings like Plug and Play redirection are turned off if not needed, and device restrictions are in place to block unauthorized devices.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
