MSNightmare has Released a Windows Defender Update DoS Vulnerability Called BigDiskBuster
Researcher MSNightmare released BigDiskBuster, a PoC that exhausts disk space and locks MRT.exe to stop Windows Defender security updates from installing.
Security researcher MSNightmare, also known as Nightmare-Eclipse, released BigDiskBuster, a proof-of-concept denial-of-service tool that starves Windows Defender's platform and security-intelligence update installer of disk space. It creates hidden delete-on-close temp files claiming free space and opens MRT.exe with restrictive sharing permissions, yielding 'protection definition update failed' error 0x80070643 in the researcher's test. The researcher claims it works across all supported Windows versions, but the experimental code is buggy, compatibility is unverified, and no in-the-wild abuse is reported. Defenders should hunt for free-space collapses, hidden Temp files, persistent MRT.exe handles, and recurring Defender update failures rather than trusting error 0x80070643 alone.
- PoC watches for Defender update directories and exhausts disk space with hidden delete-on-close temp files
- It also locks MRT.exe with restrictive sharing permissions to block write or delete access
- Researcher reports it works on all supported Windows versions, but this is unverified and the code is buggy
- Defenders should hunt for free-space collapses, MRT.exe handles, and recurring Defender update failures
- Vendors
- Microsoft
- Organizations
- Nightmare-Eclipse
From the original article
2 min read at cybersecuritynews.com
Security researcher MSNightmare, also known as Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept denial-of-service technique designed to stop Microsoft Defender Antivirus from completing platform and security-intelligence updates. The project is presented as a successor to UnDefend.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.