Feeds

Mystery Chrome 0-day exploit to be unveiled in India on Saturday

I don't want $60k, I want FAME?

Next gen security for virtualised datacentres

A Georgian security researcher is due to present details of an unpatched vulnerability in Google's Chrome browser at the Malcon security conference in India over the weekend.

Years ago the circumstances of Ucha Gobejishvili's presentation would hardly have raised an eyebrow but that was before Google began offering up to $60,000 in bug bounties for the low-down on most serious, remotely exploitable bugs in its Chrome web browser software.

Gobejishvili has apparently forgone potential financial rewards by leaving Google in the dark before unwrapping a remotely exploitable hole in the Chrome web browser, which reportedly involves a critical vulnerability in a Chrome DLL. More details are due to emerge at a presentation by Gobejishvili at the International Malware Conference (MalCon) in New Delhi on Saturday (24 November).

Conference notes say that the presentation, entitled Project Calypso, Art of Infection, will cover browser exploitation methodologies and focus on the aforementioned Chrome zero-day vulnerability.

Ucha Gobejishvili, 19, is described as system administrator at a small firm who is active as a penetration tester and vulnerability researcher. Files on Packet Storm suggest that Gobejishvili has carried out research on a Firefox 13.0 remote denial of service exploit and he has also been linked with the discovery of a cross-site scripting flaw on Skype's webstore earlier this year.

Gobejishvili told Security Ledger that he had no plans to release proof of concept code for the Chrome exploit on Windows systems he claims to have discovered. He says he's holding off on publishing details because the issue is dangerous, though paradoxically he doesn't seem to be working with Google in helping to develop a fix. He doesn't appear to be working with exploit brokers either. Gobejishvili's general reticence is shrouded in some mystery.

Google is aware of Gobejishvili's claims, although it apparently hasn't been in touch with him directly. Pending more details, Google (much like any other interested party) is only able to monitor the situation and await further developments. We're awaiting word from the internet giant's Indian arm and will update this story as and when we hear more.

Malcon promises to be an interesting conference all round, with teenage security research prodigies playing a central role in more ways than one. Gobejishvili will share the stage with Shantanu Gawde, 16, who is due to present a demo of the first Windows Mobile 8 malware. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New twist as rogue antivirus enters death throes
That's not the website you're looking for
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.