Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
Summary
Security researchers have revealed a new "Plug and Pwn" attack that exploits the Windows Plug and Play feature. This attack allows malicious actors to trick Windows into installing vulnerable vendor software, ultimately granting them SYSTEM privileges.
IFF Assessment
This attack can lead to unauthorized SYSTEM access on Windows machines, posing a significant risk to defenders by compromising critical system privileges.
Severity
The attack vector is physical (local access required to plug in the device), but it exploits a design flaw in Windows Plug and Play to achieve a high level of privilege (SYSTEM) with low user interaction, leading to significant impact.
Defender Context
Defenders should be aware of attacks that leverage the inherent trust placed in hardware connections like USB devices. Implementing stricter controls on USB device usage and ensuring that vendor software is up-to-date and vetted can mitigate such risks. This highlights the importance of layered security beyond software vulnerabilities.