Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
- ID
- 13040
- Status
- summarized
- Published
- 11 Aug 2026, 6:48 PM
- Fetched
- 11 Aug 2026, 8:18 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/researchers-turn-usb-auto-install-into.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 11 Aug 2026, 8:22 PM
- Tags
- Audience
- developers
What happened
Researchers Alejandro Hernando and Borja Martinez demonstrated at DEF CON 34 that Windows 11's Plug and Play auto-install can be chained into full SYSTEM execution on a fully updated machine. The physical path emulates a Sierra Wireless device to install SwiService.exe, abuses its SetDNS primitive, then emulates a Sony FeliCa reader whose co-installer fetches config over plaintext HTTP with a path-traversal flaw to plant a DLL in System32. A remote variant forges synthetic USB traffic over RDP using a phantom Intel RealSense device and a CRYPTBASE.dll search-order hijack, though Microsoft notes RDP USB redirection is not enabled by default.
Why it matters
If your team runs Windows 11 endpoints with RDP USB redirection enabled or allows untrusted USB devices on managed machines, this chain gives an unprivileged user or authenticated RDP user a path to SYSTEM. The practical action is to verify that low-level USB redirection over RDP is disabled (Microsoft says it is off by default) and restrict physical USB device installation on shared or kiosk-style Windows machines.
Discussion angle
Whether your startup or dev team's Windows-based CI, testing, or kiosk machines have RDP USB redirection or unrestricted PnP auto-install enabled — and whether this research changes your posture on physical USB access policies.