Cybersecurity
Naceri releases Windows Defender exploit that blocks updates
Abdelhamid Naceri released BigDiskBuster, a proof of concept he said blocked Microsoft Defender definition updates on supported Windows versions, and tied the release to a dispute with Microsoft over his termination.
- Abdelhamid Naceri released BigDiskBuster over the weekend and said it blocked Microsoft Defender definition updates.
- He said the tool worked on supported Windows versions and had to keep running in the background to stop updates.
- Naceri said the release was part of an ongoing dispute with Microsoft over his termination in March 2025.
- Two weeks earlier, he had released ShieldCrash, which he said gave SYSTEM access and bypassed RoguePlanet, a flaw he had disclosed in June and Microsoft patched in July.
- Microsoft had already fixed some other flaws Naceri disclosed, including ShieldBreak, while other issues still lacked official patches.
Naceri released BigDiskBuster over the weekend and described it as a Defender zero-day that stopped definition updates. He said the tool could block updates on supported Windows versions while it was running in the background.
He said the release was linked to an ongoing dispute with Microsoft over his termination in March 2025. The article also said he had released several Windows privilege-escalation exploits five years earlier.
Two weeks earlier, he had released ShieldCrash, another Defender exploit. He said it gave SYSTEM access and bypassed RoguePlanet, which he had disclosed in June and which Microsoft patched in July.
Microsoft had already fixed some of the flaws he disclosed, including ShieldBreak. The article said the remaining issues still had no official patch, and Microsoft was not immediately available for comment on BigDiskBuster.
Named in this story
People
- Abdelhamid Naceri
- security researcher who released BigDiskBuster
Companies
- Microsoft
- company that had patched some disclosed flaws and was asked for comment
Products and systems
- Microsoft Defender
- antivirus product targeted by the exploit
- BigDiskBuster
- proof of concept that blocked Defender updates
- ShieldCrash
- earlier Defender exploit Naceri released
- RoguePlanet
- Defender flaw ShieldCrash was said to bypass
- ShieldBreak
- earlier flaw Microsoft had already fixed
How the source tells it
The article was mostly matter-of-fact, with a slight adversarial edge from the dispute with Microsoft and Naceri's own self-serving description of the tool.
- conflict the release was framed as part of an ongoing dispute with Microsoft