BigDiskBuster released with claim it blocks Microsoft Defender updates
SecurityUnverifiedUpdated:
A newly released zero-day proof of concept, BigDiskBuster, is claimed to leave Microsoft Defender on its current version by preventing its antivirus updates while the tool is active.
A proof of concept claims to block updates
BleepingComputer reported that Abdelhamid Naceri, also known as Nightmare Eclipse, released BigDiskBuster over the weekend. Naceri said the zero-day exploit works on all supported Windows versions and, when left running in the background, prevents Microsoft Defender from performing platform and signature updates.
He described the proof of concept as buggy and needing further rewriting. Microsoft had not immediately provided comment to BleepingComputer.
Before BigDiskBuster was released, this newly disclosed tool was not publicly available.
Security researcher Abdelhamid Naceri released BigDiskBuster, a proof of concept claimed to stop Microsoft Defender platform and signature updates while it runs in the background.
The researcher also describes a buggy implementation
If the claim is accurate, an active background process could prevent Defender from receiving platform and signature updates, keeping it on an older version. The reported tool is described as a denial-of-service zero-day affecting Defender updates rather than a conventional malware infection.
Sources
- BleepingComputerNew Windows Defender zero-day blocks Microsoft antivirus updatesRead source →