NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
NightmareEclipse released BigDiskBuster, a PoC that blocks Microsoft Defender platform and signature updates by exhausting disk space.
Researcher Abdelhamid Naceri (NightmareEclipse) published the BigDiskBuster PoC, which leaves Defender running but unable to install platform and security intelligence updates. The tool waits for an update to start, fills the drive with hidden temporary files, and holds a restrictive handle on MRT.exe, releasing space once the update fails (screenshot shows error 0x80070643). The researcher claims it works on all supported Windows versions, which is unverified, and there is no indication of real-world use. It is the latest release in an ongoing public feud with Microsoft over vulnerability disclosure, following RoguePlanet, LegacyHive, ShieldBreak, and ShieldCrash.
- PoC keeps Defender running but stuck on outdated signatures and platform version
- Fills disk with hidden files and locks MRT.exe to break the update process
- Claim of all supported Windows versions affected is unverified; no in-the-wild abuse observed
- Stale definitions could reduce detection of newly identified malware
Full article638 words · extracted from theregister.com · click to collapse
REG AD
security
BigDiskBuster leaves Microsoft's antivirus running but unable to install updates
Serial Microsoft zero-day leaker NightmareEclipse has found another way to mess with Windows Defender, this time by stopping the antivirus from updating itself.
The security researcher, also known as Abdelhamid Naceri, released a proof-of-concept dubbed “BigDiskBuster” that is designed to prevent Microsoft Defender Antivirus from installing platform and security intelligence updates.
“Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background,” NightmareEclipse said.
REG AD
The researcher describes BigDiskBuster as similar to their earlier “UnDefend” tool and claims it works on all supported versions of Windows, although they admit the current PoC is “a bit buggy and needs some rewritting [sic].” That compatibility claim has not been independently verified.
REG AD
The trick doesn't disable Defender. Instead, the PoC waits for an update to start, then tries to fill up the drive so there isn't enough space for it to finish.
The code does this by creating hidden temporary files sized to consume the drive's free space, spinning up additional threads as needed to claim more. Once it detects that the Defender update has failed, it closes the files and returns the space.
BigDiskBuster also opens Microsoft's Malicious Software Removal Tool executable, MRT.exe, in a way that restricts other processes' access to the file while the handle remains open.
The result, according to NightmareEclipse, is that Defender stays stuck on its current platform and security intelligence versions as long as the tool keeps interfering with updates.
A screenshot published alongside the PoC shows Windows Security reporting that a protection definition update failed with error 0x80070643. That's a generic installation error, however, and isn't evidence on its own that BigDiskBuster is at work.
Leaving Defender stuck on old security intelligence is obviously less than ideal. The antivirus may still be running, but preventing it from receiving Microsoft's latest threat definitions could leave it less able to identify newly detected malware.
The steady stream of bugs from NightmareEclipse comes amid a very public spat between the researcher and Microsoft over the company's vulnerability disclosure process. The researcher began dumping Windows zero-days and proof-of-concept code in April, claiming Microsoft had mistreated them and cut off their access to its vulnerability reporting system.
Redmond wasn't exactly thrilled. In May, Microsoft criticized NightmareEclipse for releasing vulnerabilities without giving it a chance to fix them first, saying none of the initial bugs had been reported through its official channels. The company also invoked its Digital Crimes Unit, saying it would pursue cases against people engaged in malicious activity or enabling cybercrime – language widely interpreted as a threat of legal action against the researcher.
REG AD
That went down about as well as you'd expect with the security community. Microsoft subsequently walked back the rhetoric, saying it had “no intention to pursue action against individuals conducting or publishing security research.” By then, however, NightmareEclipse's earlier GitHub account had also been taken down, along with access to Microsoft's vulnerability reporting portal.
The peace offering didn't end the feud. NightmareEclipse continued releasing Windows exploits, including RoguePlanet in June, LegacyHive in July, ShieldBreak in August, and ShieldCrash in September. Several of the researcher's earlier zero-days have since been patched by Microsoft, while some were exploited in the wild after their public release.
BigDiskBuster is a rather different beast. Rather than providing an obvious route to SYSTEM privileges, it interferes with one of the basic things antivirus software needs: updating itself.
There’s currently no indication that BigDiskBuster has been used in real-world attacks, and NightmareEclipse's claim that it works across all supported Windows versions remains unverified.
Redmond has not responded to The Register's questions. In the meantime, its Nightmare apparently shows no sign of ending.®