Fake USB and RDP Devices Can Grant Attackers SYSTEM Privileges on Windows

·1 views

Security researchers have demonstrated a technique called 'Plug and Pwn' that exploits Windows Plug and Play to gain SYSTEM-level privileges by connecting fake or virtual USB devices. The attack works by tricking Windows into recognizing spoofed hardware — such as a Sierra Wireless or Sony FeliCa device — prompting automatic signed driver downloads from Windows Update and installation with SYSTEM privileges. A second attack chain abuses RDP USB redirection to deliver a crafted virtual device descriptor, exploiting Intel RealSense driver co-installers to execute malicious code without physical access. Neither user login nor UAC approval is required, making the attack appear as routine device setup behavior to the operating system. Mitigations include disabling RDP PnP redirection, enforcing device installation restrictions by Hardware ID, blocking Windows Update driver downloads, and applying vulnerable driver blocklists.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Documents HTML Dashboard Build Focusing on Accessibility and Structure

A developer shared progress on a Fullstack Roadmap project, detailing the construction of a structured dashboard using layered HTML containers. The project incorporated key UI components such as a sidebar for navigation, a form for filtering module progress, and cards for organized content presentation. A major focus was placed on accessibility, specifically the correct use of ARIA attributes: aria-label for describing visual-only elements and aria-current for identifying the active page. The developer noted that most bugs encountered during the project were related to improper or missing ARIA implementations. The post emphasizes that using familiar tools intelligently, rather than chasing new ones, can yield strong results, and invites fellow beginners to reflect on the importance of accessibility in user experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Developers Can Use Internet Scanning Tools to Spot Accidentally Exposed APIs

Misconfigured firewalls or overlooked load balancer settings can inadvertently expose internal APIs and development environments to the public internet, creating serious security risks. Tools like ScanSearch function as search engines for internet-connected devices and services, allowing developers to query for exposed endpoints, open ports, and HTTP responses at scale. Developers can use such tools to verify that internal services remain inaccessible externally, detect misconfigurations like exposed Git repositories or environment files, and map unintended public-facing assets. A common vulnerability involves API documentation endpoints — such as Swagger UI at paths like /api-docs — being publicly accessible without authentication, potentially giving attackers a full blueprint of an API. Proactively searching for these exposures using targeted queries helps development teams identify and remediate risks before malicious actors can exploit them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Proposes Two-Tier LLM Routing to Cut Costs Without Sacrificing Output Quality

A software developer has outlined a two-tier LLM pipeline that routes tasks to a cheaper model by default and falls back to a more capable, costlier model only when the output fails a deterministic check. The key design principle is that no language model is allowed to judge its own or a peer's output — validation is handled exclusively by objective tools such as test suites, JSON schema validators, or regex checks. Every routing decision is logged to a JSONL audit file, making the system's behavior traceable and measurable over time. The pipeline is built to be provider-agnostic, compatible with any service that supports the OpenAI-compatible chat API. The author notes the article was prepared as part of outreach for MonkeyCode, a platform that provided free model access used during development.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apache STeVe v3: How the ASF Rebuilt Its Member Voting System from Scratch

The Apache Software Foundation (ASF), which governs some of open source's most critical projects, recently ran its annual Members' Meeting election on a fully rebuilt version of its voting platform, Apache STeVe v3. The system allows roughly 800 ASF members to elect a Board of Directors and admit new members without any corporate or vendor influence over the process. Built on modern tools including Python's asfquart framework, Bootstrap, and SortableJS, the new version was developed as a standard open-source Apache project with public code and community-driven decisions. A key feature of STeVe v3 is its privacy architecture: every vote is encrypted using Argon2 key derivation and Fernet symmetric encryption, ensuring no ballot can be linked to an individual voter — even by the system's own administrators. The tally process intentionally takes 15 to 60 minutes due to the computational cost of reversing the encryption, a deliberate design choice that strengthens security as hardware improves over time.

0 comments Read more at DEV Community