FAKE USB DEVICES EXPLOIT WINDOWS TO GAIN SYSTEM ACCESS

The attack works by using fake USB devices to trigger Windows' automatic driver installation process. When connected, the devices prompt Windows to install attacker-controlled vendor software, which runs with elevated SYSTEM privileges—the highest permission level on Windows machines. Researchers demonstrated that the Plug and Play feature, designed for hardware convenience, can be weaponized to execute malware with administrative access. This bypasses standard user permission prompts and security warnings. The vulnerability affects Windows systems that automatically install drivers without user interaction. Once SYSTEM access is gained, attackers can execute arbitrary code, install persistent malware, or move laterally across networks. The attack requires physical access to a target machine, limiting its scope to scenarios involving compromised devices, office environments, or social engineering. Organizations should disable automatic driver installation and enforce USB restrictions on sensitive systems.