Executive Summary
The research presented at DEF CON 34, titled "Plug & Pwn," details how the Windows Plug-and-Play (PnP) mechanism can be exploited to bypass security boundaries. By emulating specific USB hardware identities (VID/PID), an attacker can force Windows to automatically download and install signed but vulnerable vendor packages from Microsoft's servers as `NT AUTHORITY\SYSTEM`. This occurs without user interaction, administrator privileges, or even a logged-in user.
The attack chain involves chaining low-severity logical bugs in components from vendors such as Sierra Wireless, Sony, Wacom, and Atheros. Notably, the researchers demonstrated "NoPlug & Pwn," which uses RDP USB redirection (URBDRC) to forge these hardware identities over a network connection, turning a standard RDP session into a remote Local Privilege Escalation (LPE) vector in environments where USB redirection is enabled.
This research is critical because it shifts the attacker's requirement from finding a zero-day in the OS to identifying logic flaws in the vast library of signed drivers available on Windows Update. Organizations utilizing VDI or managed RDP environments are particularly at risk if USB redirection policies are not strictly controlled.