Security researchers have disclosed a new attack method that leverages the inherent trust in Windows 11’s automated driver installation to achieve full SYSTEM privileges. The technique, detailed on 11 August, does not exploit a traditional software flaw but rather manipulates the legitimate Plug and Play (PnP) workflow designed for seamless hardware setup.
The attack begins when an emulated USB device triggers the operating system's automatic driver search. Instead of a malicious driver, the researchers supply a chain of legitimate, vendor-signed installer components. The system, trusting these signed packages, executes them with elevated privileges, ultimately creating a path to complete administrative control. This demonstrates a critical vulnerability in the trust model applied to automated hardware enumeration processes.
The threat is compounded by its potential for remote exploitation. The same PnP activation sequence can be initiated over a Remote Desktop Protocol (RDP) session if USB or device redirection is enabled. This remote vector transforms a physical-access requirement into a network-based attack, posing a significant risk to enterprise environments and remote work setups.
Microsoft has responded to the disclosure, confirming it is investigating the reported research. The company stated there is no indication of active exploitation in the wild but has not yet issued a patch or comprehensive mitigation guidance.
The findings necessitate immediate action from IT administrators. Key defensive steps include auditing remote access infrastructure to disable Plug and Play and USB redirection where not essential. The incident also highlights broader concerns about systemic trust, showing that digitally signed code can be subverted when the installation workflow itself is compromised. It underscores the need for security policies that scrutinize automated deployment mechanisms and do not rely solely on signatures as a guarantee of safety.
For defenders, the disclosure is a prompt to re-examine default automation features and group policies. Monitoring for anomalous PnP requests and enforcing strict controls over driver installation are recommended practices. The research fuels ongoing debate about trust-chain vulnerabilities in operating systems, emphasizing that robust defense requires layered controls that account for the misuse of legitimate administrative functions.
安全研究人員披露了一種新的攻擊方法，該方法利用 Windows 11 自動驅動程式安裝中固有的信任機制，以取得完整的 SYSTEM 權限。這項於8月11日詳述的技術，並非利用傳統的軟件漏洞，而是操縱了旨在實現無縫硬件設置的合法隨插即用工作流程。
攻擊始於一個模擬 USB 設備觸發操作系統的自動驅動程式搜尋。研究人員提供的不是惡意驅動程式，而是一系列合法的、經供應商簽署的安裝組件。系統信任這些簽署的套件，以提升的權限執行它們，最終創造出通向完全管理員控制的路徑。這揭示了應用於自動化硬件列舉過程的信任模型存在一個關鍵漏洞。
該威脅因潛在的遠端利用能力而加劇。如果啟用了 USB 或設備重定向，相同的 PnP 啟動序列可以透過遠端桌面協議會話發起。這種遠端向量將實體存取要求轉化為基於網絡的攻擊，對企業環境和遠端工作設置構成重大風險。
微軟已對此次披露作出回應，證實正在調查所報告的研究。該公司表示，目前沒有跡象表明該漏洞在野外已被積極利用，但尚未發布補丁或全面的緩解指南。
這些發現要求 IT 管理員立即採取行動。關鍵的防禦步驟包括審計遠端存取基礎設施，以在非必要時禁用隨插即用和 USB 重定向。此次事件也突顯了對系統性信任的更廣泛擔憂，表明當安裝工作流程本身被破壞時，數碼簽署的代碼也可能被濫用。它強調了制定安全策略的必要性，這些策略應審視自動化部署機制，而非僅依賴簽署作為安全保障。
對於防禦者而言，此次披露是重新審視預設自動化功能和群組原則的契機。建議採取的措施包括監控異常的 PnP 請求，並對驅動程式安裝實施嚴格控制。這項研究為操作系統中信任鏈漏洞的持續辯論增添了新的論據，強調強大的防禦需要多層次的控制，以考慮到合法管理功能被濫用的可能性。