Plug and Pwn attack uses fake USB devices for Windows SYSTEM access

Security researchers presented "Plug and Pwn", a set of attacks that exploit Windows Plug and Play device installation to cause the OS to download and execute signed vendor drivers and co-installers as NT AUTHORITY\SYSTEM; demonstrations include USB device emulation (FaceDancer) and an RDP USB-redirection "NoPlug & Pwn" that can achieve SYSTEM privileges without user interaction. The report shows practical chains (e.g., Sierra Wireless + Sony FeliCa, Intel RealSense via RDP) against updated Windows systems, notes mitigations like the DisableCoInstallers registry key and device allow-lists, and warns these measures reduce but do not eliminate the attack surface.