Major Security Glitch Allows Gemini to Broadcast Messages From Locked Android Phones
Security and convenience are in constant conflict, and Google’s top-notch AI assistant was recently caught in a rather inconvenient situation – it lost the game. Security experts revealed a major flaw in Android 16, which lets anyone gain access to the phone, bypassing all forms of authentication.
The trick consists of taking advantage of a bug in the way that the Gemini assistant interacts with the lock screen of the device, enabling an attacker with access to a locked smartphone to perform actions such as sending text messages and WhatsApp conversations without entering any passwords or fingerprint/PIN codes.
The process of hacking the device takes no more than a quick gesture from the would-be hacker. In ordinary circumstances, Gemini should not be able to bypass the permission restrictions in the app and request the user to unlock the device.
But when the attacker simultaneously touches the “Continue” button (which requires a PIN) and the “Add attachment” button in the assistant, the process of authentication is bypassed, and Gemini performs commands allowing the attacker to send text messages, view message history, and connect disconnected apps.
Although this hack cannot be exploited remotely by any hackers via the internet, the potential for harm is very significant in reality. Leaving the unguarded smartphone on the desk, lending it to someone known, or losing the smartphone while traveling in a crowded metro can instantly make it a source of social engineering attacks and identity theft.
The company Google has already admitted to the problem of lock screen bypass and is now working on fixing it with a software update. However, until the patch comes to your smartphone, you can protect yourself from the hack quite simply. It is enough to turn off the “Use Gemini without unlocking” option in the settings.
