Chaotic Eclipse Releases BigDiskBuster Exploit for Windows Defender DoS Vulnerability
Researcher unveils PoC exploit disrupting Microsoft Defender updates across Windows versions.
1Windows Defender DoS Exploit
Security researcher Chaotic Eclipse released BigDiskBuster, a proof-of-concept exploit targeting a zero-day denial-of-service vulnerability in Microsoft Defender. The exploit prevents Defender from receiving critical platform and signature updates, similar to the previously disclosed UnDefend exploit. Chaotic Eclipse notes the current PoC is unstable but functional across all supported Windows versions. This marks the researcher's latest in a series of zero-day releases targeting major security vendors.
2Multi-Vendor Targeting
Chaotic Eclipse has recently released exploits for Kaspersky Endpoint Security (HardBreacher), Avast Antivirus (PrettyPrague), and Crowdstrike Falcon (FalconFlank). Each exploit demonstrates privilege escalation vulnerabilities in these enterprise security products. The Kaspersky exploit creates a DLL in System32 with full permissions, while the Avast exploit dumps the Windows SAM database. The Crowdstrike exploit abuses Falcon's macro removal feature for privilege escalation. All work on fully patched systems including Windows 11 25H2.
3Researcher Background
Chaotic Eclipse recently revealed his identity as Abdelhamid Naceri, a former Microsoft employee in Germany and the UK. Naceri claims Microsoft terminated his employment without clear justification, leading to a prolonged legal battle in German labor courts. He alleges the dispute left him with minimal compensation and significant personal distress, including psychiatric treatment. Naceri previously fabricated claims about Microsoft taking legal action against researchers, during debates about vulnerability disclosure practices.
4Exploit Characteristics
BigDiskBuster specifically targets the update mechanism in Microsoft Defender, preventing it from receiving critical security updates. This could leave systems vulnerable to other attacks even if they appear protected. The researcher notes the current implementation is buggy and requires refinement, suggesting the vulnerability may be more severe than the PoC currently demonstrates. Similar to previous exploits like ShieldCrash, this targets core Defender functionality rather than edge cases.
5Vendor Response Challenges
Chaotic Eclipse has a history of publicly releasing zero-day exploits after criticizing vendors' vulnerability handling. His releases including Undefend and RedSun Defender have been exploited in the wild. The researcher's approach fuels ongoing debates about responsible disclosure versus full public release. Vendors face pressure to patch vulnerabilities quickly when working exploits become publicly available, but some argue this approach unnecessarily exposes users to risk.
6Potential Product Impact
The Avast exploit may affect other Gen Digital products including AVG and Norton, according to the researcher. Similarly, the Crowdstrike Falcon exploit abuses a legitimate remediation feature, suggesting other security products with similar capabilities might be vulnerable to comparable attacks. These cross-product implications highlight how security features designed to operate with high privileges can become attack vectors if not properly secured.
7Technical Implementation Details
The Kaspersky exploit requires multiple attempts but ultimately grants full user permissions, while the Avast exploit achieves SYSTEM-level access through the product's sandbox. The Crowdstrike exploit leverages the product's own high-privilege macro removal function. These varied approaches demonstrate how different security products can be compromised through their own privileged operations, rather than through traditional vulnerability patterns.
8Security Industry Implications
Chaotic Eclipse's continued release of working exploits against major security vendors highlights systemic challenges in enterprise security products. The researcher's focus on privilege escalation and update mechanisms suggests these are particularly vulnerable areas. While vendors typically patch these vulnerabilities quickly after disclosure, the repeated pattern indicates fundamental architectural issues in how security products manage privileges and updates that require deeper solutions.