Plug and Pwn: New USB Attack Uncovers Windows Vulnerabilities
The Plug and Pwn attack exploits Windows' Plug and Play feature, allowing unauthorized SYSTEM access through emulated USB devices. Researchers presented this at DEF CON 34.
A newly discovered attack, known as "Plug and Pwn," leverages the Windows Plug and Play feature to grant unauthorized SYSTEM access by manipulating the installation of vendor software through emulated USB devices. Presented by security researchers Alejandro Hernando and Borja MartÃnez at DEF CON 34, this attack takes advantage of how Windows automatically identifies connected hardware and installs matching drivers, potentially leading to severe vulnerabilities.
The Plug and Pwn Attack Explained
The Plug and Pwn attack exploits the Windows device installation process, which includes downloading and executing software with SYSTEM privileges when new hardware is detected. This automated process can lead to serious security risks if the installed software contains exploitable components. Hernando elaborated, saying that the exploitation does not require user interaction or even the presence of a logged-in user, allowing attackers to obtain SYSTEM privileges quickly.
Key Mechanics Behind the Attack
The research highlights a crucial component of Windows systems: co-installers, which are automatically invoked to download necessary vendor software when a USB device is connected. This automatic process can be abused, as evidenced by past vulnerabilities. For instance, a well-known 2021 incident involved exploiting a vulnerability related to Razer devices to escalate user privileges. Plug and Pwn extends this concept by targeting the device installation path directly rather than a specific vendor’s installer.
Technical Implementation and Tools
To mimic USB devices, researchers utilized tools like FaceDancer, Cynthion, and GreatFET, built on a compact Linux platform. FaceDancer facilitates the emulation of USB devices, allowing the system to recognize and install drivers associated with the emulated hardware. By creating various identities through re-enumeration tactics, the researchers demonstrated a capability to exploit different vulnerabilities in driver installations.
Attack Variety
Among the notable demonstrations, the researchers impersonated a Sierra Wireless device to manipulateDNS settings and a Sony FeliCa device to install vulnerable software. The process allowed them to create scenarios where malicious files were introduced into the system, ultimately establishing SYSTEM-level access.
Types of Attacks Demonstrated
| Attack Type | Description | Required User Interaction | Attack Duration |
|---|---|---|---|
| Zero-click Physical Attack | Emulation of Sierra Wireless and Sony FeliCa devices to execute signed package installations. | No | Approximately 5 minutes |
| NoPlug & Pwn (RDP Attack) | Using modified RDP USB redirection to exploit remote Windows systems. | No | Not explicitly measured |
Direct Implications for Users and Organizations
The implications of these vulnerabilities are substantial, especially in environments where sensitive data is handled. The research pointed out that when the Plug and Pwn attacks successfully gain SYSTEM access, attackers can perform a variety of damaging actions without raising alarms. While enabling the 'DisableCoInstallers' registry value can hinder some of these attacks, it does not eliminate the risk entirely. Hernando emphasized that while such measures can disrupt parts of the attack sequences, they do not sufficiently cover the entire attack surface, which includes multiple components of Windows’ Plug and Play infrastructure.
Security Recommendations
For organizations concerned about the Plug and Pwn vulnerabilities, several recommendations have been proposed:
- Enable the 'DisableCoInstallers' registry value to block unwanted co-installations.
- Implement device installation restrictions or hardware-ID allow-lists to minimize risk.
- Disable Plug and Play device redirection in virtual desktop environments where feasible.
Future Considerations and Industry Responses
As researchers have yet to report all underlying attack methods as vulnerabilities to specific vendors, many of these methods hinge on combinations of existing functionalities rather than standalone flaws. This aspect complicates the landscape for cybersecurity, as organizations may find it challenging to pinpoint and resolve these issues without timely disclosures from hardware vendors.
The researchers caution that, in scenarios where attackers possess valid credentials, the efficacy of existing mitigation measures declines sharply, underscoring the need for a proactive approach to security management that goes beyond mere compliance checks.
Key Takeaways
- The Plug and Pwn attack targets Windows Plug and Play features, exploiting how the OS installs vendor software.
- Attack implementations can rank from zero-click physical exploitation to remote RDP attacks.
- Security recommendations include enabling DisableCoInstallers and device installation restrictions.
- Researchers emphasized the need for comments around vulnerabilities not reported to vendors yet, complicating remediation efforts.
This research definitely sheds light on critical security vulnerabilities inherent in modern operating systems, emphasizing the importance of a layered security approach and consistent updates to policies surrounding device management.
Frequently Asked Questions