|  Post Reply

I conducted a static analysis of DeepSeek, a Chinese LLM chatbot, using variation 1.8.0 from the Google Play Store. The objective was to recognize prospective security and privacy concerns.

I have actually discussed DeepSeek previously here.

Additional security and personal privacy concerns about DeepSeek have been raised.

See also this analysis by NowSecure of the iPhone version of DeepSeek

The findings detailed in this report are based simply on static analysis. This means that while the code exists within the app, there is no definitive evidence that all of it is performed in practice. Nonetheless, the existence of such code warrants examination, especially provided the growing issues around data privacy, monitoring, the prospective abuse of AI-driven applications, and cyber-espionage dynamics between global powers.

Key Findings

Suspicious Data Handling & Exfiltration

- Hardcoded URLs direct data to external servers, raising issues about user activity tracking, such as to ByteDance "volce.com" endpoints. NowSecure recognizes these in the iPhone app yesterday also.
- Bespoke file encryption and data obfuscation approaches exist, with signs that they might be used to exfiltrate user details.
- The app contains hard-coded public keys, rather than relying on the user device's chain of trust.
- UI interaction tracking records detailed user habits without clear permission.
- WebView control is present, which could enable for the app to gain access to private external internet browser data when links are opened. More details about WebView controls is here

Device Fingerprinting & Tracking

A substantial part of the evaluated code appears to concentrate on event device-specific details, which can be utilized for tracking and fingerprinting.

- The app gathers numerous unique device identifiers, consisting of UDID, Android ID, IMEI, IMSI, and provider details.
- System residential or commercial properties, set up plans, and root detection mechanisms recommend possible anti-tampering steps. E.g. probes for the existence of Magisk, a tool that personal privacy advocates and security researchers use to root their Android devices.
- Geolocation and network profiling exist, suggesting potential tracking capabilities and enabling or disabling of fingerprinting regimes by area.
- Hardcoded gadget model lists recommend the application may act differently depending upon the discovered hardware.
- Multiple vendor-specific services are used to extract extra gadget details. E.g. if it can not figure out the device through basic Android SIM lookup (since approval was not given), it tries maker specific extensions to access the same details.

Potential Malware-Like Behavior

While no definitive conclusions can be drawn without dynamic analysis, a number of observed behaviors align with known spyware and malware patterns:

- The app utilizes reflection and UI overlays, drapia.org which might facilitate unapproved screen capture or phishing attacks.
- SIM card details, identification numbers, and other device-specific information are aggregated for unidentified purposes.
- The app executes country-based gain access to constraints and "risk-device" detection, suggesting possible surveillance systems.
- The app carries out calls to pack Dex modules, where extra code is filled from files with a.so extension at runtime.
- The.so submits themselves turn around and make additional calls to dlopen(), which can be utilized to pack additional.so files. This facility is not typically checked by Google Play Protect and other fixed analysis services.
- The.so files can be implemented in native code, such as C++. Using native code adds a layer of complexity to the analysis procedure and obscures the full level of the app's capabilities. Moreover, native code can be leveraged to more quickly escalate privileges, potentially making use of vulnerabilities within the operating system or gadget hardware.

Remarks

While information collection prevails in modern-day applications for debugging and improving user experience, aggressive fingerprinting raises substantial personal privacy issues. The DeepSeek app requires users to visit with a valid email, which must already provide enough authentication. There is no valid reason for the app to aggressively collect and transfer unique device identifiers, IMEI numbers, SIM card details, and other non-resettable system homes.

The degree of tracking observed here surpasses common analytics practices, possibly allowing persistent user tracking and re-identification across devices. These habits, integrated with obfuscation strategies and network communication with third-party tracking services, require a greater level of examination from security researchers and gdprhub.eu users alike.

The work of runtime code loading as well as the bundling of native code recommends that the app could enable the release and execution of unreviewed, from another location provided code. This is a serious prospective attack vector. No proof in this report exists that remotely deployed code execution is being done, only that the facility for this appears present.

Additionally, vokipedia.de the app's approach to finding rooted gadgets appears extreme for experienciacortazar.com.ar an AI chatbot. Root detection is typically justified in DRM-protected streaming services, where security and content protection are critical, or in competitive computer game to prevent unfaithful. However, there is no clear rationale for annunciogratis.net such stringent procedures in an application of this nature, raising further concerns about its intent.

Users and organizations considering installing DeepSeek should know these possible threats. If this application is being used within an enterprise or federal government environment, bphomesteading.com additional vetting and security controls ought to be implemented before allowing its release on managed gadgets.

Disclaimer: The analysis provided in this report is based on fixed code evaluation and does not imply that all found functions are actively used. Further examination is required for definitive conclusions.

Add comment

INDEXING JOURNAL: