Researcher disables Microsoft Defender updates with new zero-day tool
BigDiskBuster prevents antivirus from receiving critical security intelligence updates
1Zero-day update blocker
Security researcher NightmareEclipse (Abdelhamid Naceri) released BigDiskBuster, a proof-of-concept tool that prevents Microsoft Defender from updating. The tool works by filling the drive's free space when Defender attempts an update, causing the process to fail. Unlike previous exploits that granted SYSTEM access, this attack targets Defender's core functionality - maintaining current threat definitions. The researcher claims compatibility with all supported Windows versions, though admits the current PoC is somewhat buggy.
2Technical execution
BigDiskBuster creates hidden temporary files sized to consume all available disk space when Defender initiates an update. It spawns additional threads to claim more space as needed, then releases the space after update failure. The tool also manipulates Microsoft's Malicious Software Removal Tool (MRT.exe) to restrict file access. This dual approach leaves Defender stuck on outdated security intelligence while the tool runs, though it doesn't disable the antivirus completely. Windows Security shows generic error 0x80070643 during failed updates.
3Security implications
While Defender remains operational without updates, its ability to detect new malware diminishes significantly. Security intelligence updates contain the latest threat definitions - without them, Defender becomes increasingly vulnerable to new attack vectors. The researcher describes this as being 'stuck with your current version.' This attack vector differs from NightmareEclipse's previous zero-days by targeting update mechanisms rather than privilege escalation, potentially making detection more challenging.
4Ongoing researcher conflict
NightmareEclipse began releasing Windows zero-days in April after a dispute with Microsoft's vulnerability reporting process. The researcher claims Microsoft mistreated them and revoked access to reporting systems. Microsoft initially threatened legal action through its Digital Crimes Unit before walking back the rhetoric. This conflict has resulted in monthly exploit releases including RoguePlanet, LegacyHive, ShieldBreak, and ShieldCrash - some later patched, some exploited in the wild.
5Microsoft's response
Microsoft has not commented on BigDiskBuster specifically. The company previously criticized NightmareEclipse for releasing vulnerabilities without allowing time for patches. Several of the researcher's earlier zero-days have been addressed in security updates. The current tool's cross-version compatibility claim remains unverified by independent sources. Microsoft maintains it won't pursue legal action against security researchers publishing their findings, despite earlier contradictory statements.
6Attack characteristics
BigDiskBuster represents a shift from privilege escalation to service disruption. Unlike previous tools that provided SYSTEM access, this focuses on weakening Defender's core protection capability. The attack requires persistence (tool running continuously) to maintain its effect. There's no evidence of real-world use currently. The technique highlights how antivirus self-update mechanisms can become attack surfaces themselves when compromised.
7Community impact
The security community has closely followed the Microsoft-NightmareEclipse conflict, with many researchers criticizing Redmond's handling of vulnerability disclosure. The public spat has raised questions about Microsoft's bug bounty program and researcher relations. Some view NightmareEclipse's actions as retaliatory, while others see them as exposing systemic issues in corporate vulnerability management. The situation continues evolving with each new exploit release.
8Defender's update criticality
Microsoft Defender relies heavily on frequent updates to maintain effectiveness against evolving threats. Security intelligence updates typically include new malware signatures and detection logic. Platform updates deliver engine improvements. Being stuck on outdated versions creates significant protection gaps, especially against zero-day threats. This attack demonstrates how disrupting update mechanisms can undermine security products without directly disabling them.