--- title: Plug and Pwn attack uses fake USB devices for Windows... description: Security researchers Alejandro Hernando and Borja Martínez presented "Plug and Pwn" at DEF CON 34, a family of attacks that abuse Windows Plug and Play and... canonical: https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Plug and Pwn attack uses fake USB devices for Windows SYSTEM access | daily.dev og:description: Security researchers Alejandro Hernando and Borja Martínez presented "Plug and Pwn" at DEF CON 34, a family of attacks that abuse Windows Plug and Play and... og:url: https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic og:image: https://api.daily.dev/og/posts/k09wcqciC.png og:image:alt: Plug and Pwn attack uses fake USB devices for Windows SYSTEM access og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Plug and Pwn attack uses fake USB devices for Windows SYSTEM access **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 7 min read · 3 upvotes · 0 comments ## Summary Security researchers Alejandro Hernando and Borja Martínez presented "Plug and Pwn" at DEF CON 34, a family of attacks that abuse Windows Plug and Play and co-installer functionality to trick Windows into installing vulnerable vendor software as NT AUTHORITY\SYSTEM. Using the FaceDancer framework with Cynthion/GreatFET hardware, they emulate USB devices (Sierra Wireless, Sony FeliCa, Intel RealSense) to chain vulnerabilities and gain SYSTEM privileges, in one case with no user logged in and in another entirely remotely over RDP without physical hardware, via a technique called "NoPlug & Pwn" that abuses RDP USB redirection. Disabling co-installers via the 'DisableCoInstallers' registry value mitigates some attack chains, including the Sony FeliCa and Intel RealSense RDP demos, but does not close the underlying attack surface, since PnP enumeration, Windows Update driver resolution, and INF-installed services (exploited via CVE-2019-10617 in an Atheros driver) remain exposed. Additional mitigations recommended include device installation allow-lists and disabling PnP redirection on RDP/VDI hosts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Plug and Pwn attack against Windows? Plug and Pwn is a family of attacks disclosed at DEF CON 34 that abuse Windows Plug and Play device installation to gain SYSTEM privileges. Using the FaceDancer framework to emulate USB devices like Sierra Wireless modems and Sony FeliCa readers, attackers trick Windows into installing exploitable signed vendor software as NT AUTHORITY\SYSTEM, chaining flaws to open a reverse shell in about five minutes. _Teams hardening endpoint security can track emerging privilege-escalation techniques like this on daily.dev._ ### Can Plug and Pwn style attacks work without physical USB hardware over RDP? Yes, a variant called NoPlug & Pwn requires no physical USB hardware at all. It abuses RDP USB redirection by sending fake USB descriptors from a custom Python RDP client, causing the remote Windows host to enumerate a phantom device and install vulnerable driver packages, such as one impersonating an Intel RealSense camera exploitable via DLL hijacking for SYSTEM access. _Admins securing virtual desktop and RDP environments follow attack research like this on daily.dev._ ### Does disabling DisableCoInstallers on Windows fully block Plug and Pwn attacks? No, setting the DisableCoInstallers registry DWORD to 1 under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer only blocks some attack chains, such as the Sony FeliCa and Intel RealSense RDP demonstrations. It does not stop PnP enumeration, Windows Update driver resolution, INF processing, or INF-installed services, as shown by a separate Wacom/Atheros chain exploiting CVE-2019-10617. _Security teams weighing mitigation trade-offs for driver installation flaws can follow updates via daily.dev._ ## Similar posts on daily.dev - [ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access](https://daily.dev/posts/shadowpad-malware-actively-exploits-wsus-vulnerability-for-full-system-access-t5bglj5jh) · The Hacker News · 0 upvotes · 0 comments - [Disclosing PhantomRPC – a privilege escalation vulnerability in RPC](https://daily.dev/posts/disclosing-phantomrpc-a-privilege-escalation-vulnerability-in-rpc-habypudyf) · Securelist · 0 upvotes · 0 comments - [New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released](https://daily.dev/posts/new-windows-miniplasma-zero-day-exploit-gives-system-access-poc-released-b1dqgpmgv) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Plug and Pwn attack uses fake USB devices for Windows SYSTEM access","url":"https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic"},"datePublished":"2026-08-12T16:08:20.939Z","dateModified":"2026-09-13T19:44:10.937Z","description":"Security researchers Alejandro Hernando and Borja Martínez presented \"Plug and Pwn\" at DEF CON 34, a family of attacks that abuse Windows Plug and Play and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/60a722893c6e736930e2ac3dd86f965b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/60a722893c6e736930e2ac3dd86f965b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,vulnerability","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Plug and Pwn attack uses fake USB devices for Windows SYSTEM access"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access-k09wcqcic#faq","mainEntity":[{"@type":"Question","name":"What is the Plug and Pwn attack against Windows?","acceptedAnswer":{"@type":"Answer","text":"Plug and Pwn is a family of attacks disclosed at DEF CON 34 that abuse Windows Plug and Play device installation to gain SYSTEM privileges. Using the FaceDancer framework to emulate USB devices like Sierra Wireless modems and Sony FeliCa readers, attackers trick Windows into installing exploitable signed vendor software as NT AUTHORITY\\SYSTEM, chaining flaws to open a reverse shell in about five minutes. Teams hardening endpoint security can track emerging privilege-escalation techniques like this on daily.dev."}},{"@type":"Question","name":"Can Plug and Pwn style attacks work without physical USB hardware over RDP?","acceptedAnswer":{"@type":"Answer","text":"Yes, a variant called NoPlug & Pwn requires no physical USB hardware at all. It abuses RDP USB redirection by sending fake USB descriptors from a custom Python RDP client, causing the remote Windows host to enumerate a phantom device and install vulnerable driver packages, such as one impersonating an Intel RealSense camera exploitable via DLL hijacking for SYSTEM access. Admins securing virtual desktop and RDP environments follow attack research like this on daily.dev."}},{"@type":"Question","name":"Does disabling DisableCoInstallers on Windows fully block Plug and Pwn attacks?","acceptedAnswer":{"@type":"Answer","text":"No, setting the DisableCoInstallers registry DWORD to 1 under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer only blocks some attack chains, such as the Sony FeliCa and Intel RealSense RDP demonstrations. It does not stop PnP enumeration, Windows Update driver resolution, INF processing, or INF-installed services, as shown by a separate Wacom/Atheros chain exploiting CVE-2019-10617. Security teams weighing mitigation trade-offs for driver installation flaws can follow updates via daily.dev."}}]} ```