Plug and Pwn Provides Further Proof Windows’ Co-installers Are Dangerous

LG’s Monitor App Was Annoying, Plug and Pwn Is Dangerous

Microsoft was unimpressed with LG installing pop up ads for McAfee along with their LG Monitor App Installer when someone plugged in certain models of LG displays.  Microsoft did not consider this a good reason to change the behaviour of Windows when a device was plugged in with what is called a co-installer; a feature which automatically downloads and installs vendor software and drivers when you plug a device in.  If you notice the software and uninstall it, you only get a temporary reprieve as the co-installer will reinstall itself every time you unplug the device and plug it back in and likely on reboots as well.

LG’s behaviour annoyed Microsoft and users both, but it didn’t endanger your security.  Plug and Pwn on the other hand does.  It uses that same co-installer feature but instead of loading ads onto your computer, it abuses fact that in their infinite wisdom, Microsoft allows the vendor-supplied components to run as SYSTEM.  This lets attackers add horrific things to a random USB device and when an unsuspecting victim plugs that device in, whatever payload is hiding on the device gets to silently run with the highest privilege going.  

This has been abused in the past and will be in the future as long as this co-installer feature is enabled by default.  Bleeping Computer covers a horrific list of infections that can spread with Plug and Pwn in this post.

Do not plug random USB devices into your machines and at least seriously consider disabling Windows’ co-installer feature with the steps found in that LG story link at the beginning of this post.