Hacking Gemini & the MCP Permission Problem
summary
Two production vulnerabilities: a misconfigured Android intent plus tapjacking lets any app populate Gemini’s chat and silently trigger a phone call with no confirmation, then encodes stolen data as DTMF tones appended to the dial string for DTMF exfiltration to the attacker; a separate service exposes an IDOR + image prompt injection chain where an attacker injects a malicious image URL into another user’s conversation, the model dereferences it and leaks financial data to the attacker’s server.
AI-written summary · about
chapters (9)
- 0:00Introduction and background
- 1:06Gemini app utilities power
- 2:49Intent misconfiguration exploit
- 4:15DTMF exfiltration technique
- 6:40IDOR and image-based attack
- 8:50Tool calls security risks
- 10:17MCP permission challenges
- 13:55Permission drift dangers
- 14:58Security recommendations
related talks
38mInvitation Is All You Need! Invoking Gemini for Workspace Agents with a Google Calendar Invite
32mHacking the Hackers’ Code: Inside Android Malware
55mFinding and Exploiting Access Control Vulnerabilities in Graphical User Interfaces
44mExposing Critical Threats In Millions Of Connected Devices
57m(In)Security of Mobile Banking
46mNot My Vibe: When AI Coding Agents Go Off the Rails
18mAI and Cybersecurity
42mHacking With Gems