Researchers achieve SYSTEM takeover on Windows 11 via USB auto-install
This digest was compiled by AI from multiple sources — links to the originals are below.
Security researchers at DEF CON 34 have demonstrated a technique to gain SYSTEM-level code execution on a fully patched Windows 11 by exploiting Plug and Play auto-install. The attack chains emulated USB devices and a path traversal flaw to plant a malicious DLL, then loads it via a signed system service. A remote variant works over Remote Desktop if USB redirection is enabled, a setting Microsoft says is off by default.
The Physical Attack Chain
Researchers Alejandro Hernando and Borja Martinez first emulated a Sierra Wireless device, causing Windows to install SwiService.exe, a SYSTEM service with a SetDNS primitive. They then redirected DNS and emulated a Sony FeliCa reader whose co-installer retrieves configuration over plaintext HTTP. A path-traversal flaw let them place a malicious DLL into System32; reconnecting the Sierra device loaded the DLL, granting SYSTEM access. The demonstration used a fully updated Windows 11 machine.
Remote Desktop Variant
The remote path replaces physical hardware with synthetic USB traffic over RDP. The researchers’ Python client forges a phantom Intel RealSense device, triggering Windows to install RealSense software in a user-writable directory. They exploited a CRYPTBASE.dll search-order hijack from that directory to execute code as SYSTEM. This remote variant requires supported Plug and Play and RemoteFX USB redirection to be enabled, which Microsoft’s documentation states is not the default configuration.
Microsoft’s Safeguards
Microsoft emphasizes that Remote Desktop Services does not allow supported Plug and Play or RemoteFX USB redirection by default. Administrators can also apply device-installation restrictions by hardware or compatible ID, device-instance ID, and setup class to block unapproved devices. On Remote Desktop servers, these policies can affect redirected devices, providing an additional layer of control.
What's Next
The researchers presented their findings at DEF CON 34 and released tooling to emulate USB devices for testing. It remains unclear if Microsoft will modify the Plug and Play auto-install behavior or issue broader guidance, as the attack chains rely on specific configuration or physical access preconditions.
1 source
Researchers achieve SYSTEM takeover on Windows 11 via USB auto-install
