MSNightmare Releases New PoC for DoS Vulnerability in Windows Defender

Severity

Medium

Detail

Security researcher MSNightmare (Nightmare-Eclipse) has released BigDiskBuster, a proof-of-concept (PoC) tool designed to prevent Microsoft Defender Antivirus from successfully installing platform and security intelligence updates. The project is positioned as a successor to the previously released UnDefend tool and demonstrates how local system resources can be abused to interfere with Defender’s update process. BigDiskBuster targets the update mechanism that focuses on exhausting available disk space and locking critical files during the update process, potentially preventing Defender from receiving the latest security intelligence, engine, and platform updates.

Although the researcher claims the PoC works across all supported Windows versions, the project is described as experimental and has not been independently verified. Nevertheless, the release highlights a potential denial-of-service (DoS) scenario where security software remains active but is unable to update, gradually reducing its effectiveness against emerging threats.

The issue is significant because Microsoft Defender relies on regular security intelligence updates to identify new malware and threat indicators. Systems prevented from receiving updates may continue to function normally while operating with outdated detection capabilities.

How?

BigDiskBuster continuously monitors the C: drive for changes within Microsoft Defender’s Platform and Definition Updates directories. When a new Defender update directory is detected, the tool calculates the available disk capacity and immediately creates a hidden temporary file designed to consume nearly all remaining free disk space.

If the Defender update process modifies or deletes files while attempting installation, additional worker threads attempt to reclaim the newly available space, repeatedly starving the update process of required storage resources.

The PoC also targets MRT.exe (Microsoft Windows Malicious Software Removal Tool) by opening the executable with restrictive file-sharing permissions. This prevents other processes from obtaining write or delete access while the file handle remains active. By combining disk-space exhaustion with file-locking techniques, BigDiskBuster can interfere with Defender’s update staging, installation, and rollback operations. Once the monitored Defender update directory disappears, indicating a failed update attempt, the tool releases the allocated disk space and closes its file handles.

A test environment published by the researcher showed Windows Security reporting error code 0x80070643 and failed protection definition updates. However, this error code is commonly associated with various installation failures and should not be considered a reliable indicator of exploitation on its own.

Conclusion

BigDiskBuster demonstrates how attackers or malicious insiders could disrupt Microsoft Defender’s ability to receive critical updates without directly disabling the security product. By abusing local disk resources and file-locking mechanisms, the PoC can potentially leave endpoints running outdated malware definitions while appearing operational.

Organizations should monitor for unusual disk-space depletion, hidden temporary files, persistent access to MRT.exe, and repeated Microsoft Defender update failures. Administrators should also review Windows Defender Operational logs for missing successful update events and investigate systems experiencing unexplained update issues. Prompt validation, process analysis, restoration of disk capacity, and forced Defender updates can help mitigate the impact of potential abuse

Source

https://cybersecuritynews.com/defender-bigdiskbuster-dos-flaw/