Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

Summary: Researchers Alejandro Hernando and Borja Martinez, presenting at DEF CON 34, chained Windows Plug and Play auto-install to SYSTEM code execution on a fully updated Windows 11 machine by emulating a Sierra Wireless device to install SwiService.exe, redirecting DNS, then emulating a Sony FeliCa reader whose co-installer's path-traversal flaw let them plant a DLL in System32. A remote variant forges a phantom Intel RealSense device over RDP USB redirection and abuses a CRYPTBASE.dll search-order hijack from a user-writable directory, though Microsoft says Plug and Play and RemoteFX USB redirection are not enabled by default.
Key Takeaway: The physical chain needs only an emulated USB device presented to the target, and the remote path needs an authenticated low-privilege user plus a redirection feature Microsoft leaves off by default - so the question is whether that feature is enabled anywhere in your estate and whether device-installation restrictions are set by hardware or compatible ID.

Read the original at The Hacker News ↗