Feeds

Mystery Chrome 0-day exploit to be unveiled in India on Saturday

I don't want $60k, I want FAME?

SANS - Survey on application security programs

A Georgian security researcher is due to present details of an unpatched vulnerability in Google's Chrome browser at the Malcon security conference in India over the weekend.

Years ago the circumstances of Ucha Gobejishvili's presentation would hardly have raised an eyebrow but that was before Google began offering up to $60,000 in bug bounties for the low-down on most serious, remotely exploitable bugs in its Chrome web browser software.

Gobejishvili has apparently forgone potential financial rewards by leaving Google in the dark before unwrapping a remotely exploitable hole in the Chrome web browser, which reportedly involves a critical vulnerability in a Chrome DLL. More details are due to emerge at a presentation by Gobejishvili at the International Malware Conference (MalCon) in New Delhi on Saturday (24 November).

Conference notes say that the presentation, entitled Project Calypso, Art of Infection, will cover browser exploitation methodologies and focus on the aforementioned Chrome zero-day vulnerability.

Ucha Gobejishvili, 19, is described as system administrator at a small firm who is active as a penetration tester and vulnerability researcher. Files on Packet Storm suggest that Gobejishvili has carried out research on a Firefox 13.0 remote denial of service exploit and he has also been linked with the discovery of a cross-site scripting flaw on Skype's webstore earlier this year.

Gobejishvili told Security Ledger that he had no plans to release proof of concept code for the Chrome exploit on Windows systems he claims to have discovered. He says he's holding off on publishing details because the issue is dangerous, though paradoxically he doesn't seem to be working with Google in helping to develop a fix. He doesn't appear to be working with exploit brokers either. Gobejishvili's general reticence is shrouded in some mystery.

Google is aware of Gobejishvili's claims, although it apparently hasn't been in touch with him directly. Pending more details, Google (much like any other interested party) is only able to monitor the situation and await further developments. We're awaiting word from the internet giant's Indian arm and will update this story as and when we hear more.

Malcon promises to be an interesting conference all round, with teenage security research prodigies playing a central role in more ways than one. Gobejishvili will share the stage with Shantanu Gawde, 16, who is due to present a demo of the first Windows Mobile 8 malware. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.