Story thread · 3 reports / 3 sources

Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11

thehackernews.com · 9hShare

Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine. The same PnP path can be triggered over Remote Desktop without physical hardware when supported Plug and Play or low-level USB redirection is enabled; Microsoft says that

First report: Open-source stealth USB hides an encrypted partition behind an 8GB decoy drive — 'Phantom Drive' appears as a regular USB stick until you create a text file to unlock the hidden data — tomshardware.com, 2d