Researcher releases BigDiskBuster zero-day that blocks Microsoft Defender updates
Summary
Researcher Abdelhamid Naceri says BigDiskBuster can block Microsoft Defender signature and platform updates while running in the background. The article reports that some of Naceri’s disclosed Windows and Defender flaws remain unpatched.
Key points
- Naceri says BigDiskBuster prevents Microsoft Defender from performing signature and platform updates while the tool runs in the background.
- Naceri claims the proof of concept works on all supported Windows versions and describes it as somewhat buggy.
- The tool follows UnDefend, another Defender zero-day Naceri released in April that reportedly blocked definition updates.
- The article says Microsoft has patched some flaws Naceri disclosed, while others still lack an official patch.
- Naceri’s other recent releases include ShieldCrash, which he says grants SYSTEM access and bypasses the previously patched ShieldBreak flaw.
Article Details
- Vulnerability Types
- Denial of service that prevents Microsoft Defender antivirus signature and platform updates
- Affected Versions
- Microsoft Defender on all supported Windows versions
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- unavailable
People
Vendors
Products
BitLockerNaceri’s zero-day exploits released this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components.Microsoft Defender Antimalware PlatformSecurity researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released BigDiskBuster, a Microsoft Defender zero-day that can block antivirus signature and platform updates on supported Windows versions.Microsoft WindowsSecurity researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released BigDiskBuster, a Microsoft Defender zero-day that can block antivirus signature and platform updates on supported Windows versions.
Tools
BigDiskBusterSecurity researcher Abdelhamid Naceri, also known as Nightmare Eclipse, released BigDiskBuster, a Microsoft Defender zero-day that can block antivirus signature and platform updates on supported Windows versions.BlueHammerNaceri’s zero-day exploits released this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components.GreenPlasmaNaceri’s zero-day exploits released this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components.LegacyHiveNaceri’s zero-day exploits released this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components.RedSunNaceri’s zero-day exploits released this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components.RoguePlanetanother ShieldBreak Defender privilege escalation flaw patched a week earlier, which itself bypassed RoguePlanet, another Defender flaw the security researcher disclosed in June and Microsoft patched in July.ShieldBreakAccording to Naceri, ShieldCrash bypasses another ShieldBreak Defender privilege escalation flaw patched a week earlier, which itself bypassed RoguePlanet, another Defender flaw the security researcher disclosed in JuneShieldCrashThe disclosure is part of Naceri’s ongoing series of Windows and Defender exploits, following earlier tools like UnDefend and ShieldCrash, with several flaws still unpatched by Microsoft.UnDefendThe disclosure is part of Naceri’s ongoing series of Windows and Defender exploits, following earlier tools like UnDefend and ShieldCrash, with several flaws still unpatched by Microsoft.YellowKeyNaceri’s zero-day exploits released this year also include LegacyHive, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend, which target Microsoft Defender, BitLocker, and other Windows components.