Cybersecurity
BigDiskBuster blocks Microsoft Defender updates
A GitHub proof-of-concept called BigDiskBuster prevented Microsoft Defender from installing updates by consuming free disk space, while its author said no patch or independent confirmation was available.
- BigDiskBuster was published on GitHub on 19 September.
- The tool stopped Microsoft Defender platform and signature updates by filling all available disk space.
- Abdelhamid Naceri said he had been dismissed from Microsoft's Security Response Center in 2024 and had been releasing exploits without coordinating with the company since April.
- The article said earlier tools by Naceri — BlueHammer, RedSun and UnDefend — were used in live intrusions before Microsoft patched them and CISA added them to its Known Exploited Vulnerabilities catalog.
BigDiskBuster appeared on GitHub on 19 September as a proof-of-concept named in the article. The report said it had no patch, no CVE and no Microsoft advisory.
The tool watched Defender's update paths on the C: drive. When Defender began downloading a platform or definition update, it created a hidden temporary file that used the remaining free space, which made the update fail.
Naceri said the tool was "a bit buggy" and seemed to work on supported Windows versions. He also said he had been dismissed from Microsoft's Security Response Center in 2024 and had been publishing exploits without coordination since April.
The article said no independent researcher had confirmed the behaviour. It also said the tool could hold open a handle on Windows Malicious Software Removal Tool in a way that would stop Windows Update from replacing it, and it listed monitoring and execution controls as possible defences.
Named in this story
People
- Abdelhamid Naceri
- the tool's author and former Microsoft security researcher
Companies
- Microsoft
- the company whose Defender products were affected and that previously patched his flaws
Organisations
- Microsoft Security Response Center
- the Microsoft team Naceri said he was dismissed from in 2024
Governments and agencies
- CISA
- the agency that added earlier Naceri flaws to its Known Exploited Vulnerabilities catalog
Products and systems
- BigDiskBuster
- the proof-of-concept tool that blocked Defender updates
- Microsoft Defender
- the update target the tool interfered with
- BlueHammer
- one of Naceri's earlier Defender tools
- RedSun
- one of Naceri's earlier Defender tools
- UnDefend
- one of Naceri's earlier Defender tools and a related flaw he disclosed in April
- Windows Malicious Software Removal Tool
- the Windows process Naceri's tool tried to hold open
How the source tells it
The piece was mostly neutral technical reporting, with a brief defensive advisory at the end.
No emotive framing was found in the original.