Researcher Releases BigDiskBuster PoC to Disrupt Microsoft Defender Updates
Summary
Abdelhamid Naceri, who used the names Nightmare Eclipse and others, released BigDiskBuster, a reportedly buggy PoC that prevents Defender updates. Microsoft says Defender detects and prevents observed activity and advises customers to update.
Key points
- Naceri released BigDiskBuster, a proof of concept described as preventing Windows Defender from completing platform and signature updates.
- The researcher says it works on all currently supported Windows versions, but cautions that the code is buggy and needs further work.
- Microsoft said Defender Antivirus detects BigDiskBuster and includes detection and prevention for observed activity.
- Microsoft advised customers to keep Defender security intelligence and platform updates current and install the latest available security intelligence.
- Naceri, previously known online as Nightmare Eclipse, claimed the identity about a week before releasing the PoC. He admitted that earlier claims that Microsoft had taken legal action against him were fabricated.
Article Details
- Affected Versions
- Windows (all currently supported versions)
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unknown
- Workarounds
- Keep Microsoft Defender security intelligence and platform updates current, and install the latest available security intelligence.
People
Abdelhamid NaceriThe researcher who released the BigDiskBuster proof of concept; he said he is known online as Nightmare Eclipse, Chaotic Eclipse, and MSNightmare.Chaotic EclipseOnline name used by Abdelhamid Naceri, according to his claim.MSNightmareOnline name used by Abdelhamid Naceri, according to his claim.Nightmare EclipseOnline name used by Abdelhamid Naceri, according to his claim.
Vendors
Products
Microsoft Defender Antivirus“Microsoft Defender Antivirus detects ‘BigDiskBuster’ and includes both detection and prevention for observed activity.Windows DefenderAccording to the project’s GitHub page, BigDiskBuster is a proof of concept “similar to UnDefend” that prevents Windows Defender from completing its platform and signature updates.