Security researchers have disclosed a new attack family, dubbed “Plug and Pwn,” that targets the Windows Plug and Play installation path, according to BleepingComputer. The report says the technique abuses the way Windows detects new hardware, locates matching driver packages, and installs vendor-supplied software under the NT AUTHORITY\SYSTEM account. The research was presented at DEF CON 34 by Alejandro Hernando and Borja Martinez, BleepingComputer reports. Their work uses software to emulate USB devices, causing Windows to treat the emulated hardware as a newly connected device and retrieve signed vendor packages tied to that device identity. The risk, as described by the researchers, is not simply that a malicious USB device is plugged in. It is that the privileged device-installation path can automatically run vendor components — including co-installers, services, support executables, and drivers — as SYSTEM, and BleepingComputer says the operating system may do this without a User Account Control prompt. According to the report, the researchers found they could force Windows to install signed vendor packages that contain exploitable components or other weaknesses, then abuse those weaknesses to gain SYSTEM privileges. Some of the demonstrated chains reportedly require no user interaction and no logged-in user. One chain, BleepingComputer says, can be performed remotely over Remote Desktop Protocol without any physical USB hardware connected to the target machine. The work builds on a known pattern. BleepingComputer points to a 2021 case involving Razer Synapse, where Windows automatically downloaded and launched the Razer installer after a Razer mouse or keyboard was connected. A flaw in that installer let a standard user open PowerShell from the installation interface, causing the shell to inherit the installer’s elevated privileges; BleepingComputer says it tested that issue at the time and confirmed SYSTEM access in roughly two minutes. Hernando told BleepingComputer that Plug and Pwn is in the same family as the Razer issue, but that the new research focuses on the Windows device-installation path rather than a single vendor’s installer. The broader point is that the trusted, automated flow for device setup can become an escalation path when the packages pulled into that flow include vulnerable components. For the demonstrations, BleepingComputer says the researchers used FaceDancer with Cynthion and GreatFET hardware connected to a small Linux computer to emulate USB devices. FaceDancer lets researchers define the descriptors, interfaces, device classes, and endpoints that an operating system uses to identify connected hardware, which is how the test setup can make Windows behave as if specific devices have been attached. Who benefits: Attackers with a path to present a convincing device identity to Windows could benefit if a target system retrieves and runs vulnerable vendor components. Security researchers and defenders also gain a clearer test case for auditing device-installation behavior. Who's exposed: Windows environments that allow automatic installation of vendor device software are the exposed population described by the report. The provided material does not quantify how many systems or vendor packages are affected.