I performed a fixed analysis of DeepSeek, a Chinese LLM chatbot, using version 1.8.0 from the Google Play Store. The objective was to determine potential security and privacy problems.

I have actually blogged about DeepSeek formerly here.

Additional security and privacy concerns about DeepSeek have actually been raised.

See likewise this analysis by NowSecure of the iPhone version of DeepSeek

The findings detailed in this report are based simply on static analysis. This indicates that while the code exists within the app, there is no conclusive evidence that all of it is carried out in practice. Nonetheless, the existence of such code warrants analysis, especially offered the growing issues around data personal privacy, security, the possible abuse of AI-driven applications, and cyber-espionage dynamics in between international powers.

Key Findings

Suspicious Data Handling & Exfiltration

- Hardcoded URLs direct data to external servers, raising concerns about user activity tracking, such as to ByteDance “volce.com” endpoints. NowSecure determines these in the iPhone app the other day as well.

• Bespoke file encryption and information obfuscation approaches exist, with indications that they could be used to exfiltrate user details.
• The app contains hard-coded public keys, instead of relying on the user gadget’s chain of trust.
• UI interaction tracking catches detailed user behavior without clear authorization. - WebView control exists, which could permit the app to gain access to private external browser information when links are opened. More details about WebView adjustments is here
  
  Device Fingerprinting & Tracking
  
  A considerable portion of the analyzed code appears to concentrate on gathering device-specific details, which can be used for tracking and fingerprinting.
  
  - The app gathers various special device identifiers, consisting of UDID, Android ID, IMEI, IMSI, and provider details.
• System properties, installed bundles, and root detection mechanisms recommend potential anti-tampering steps. E.g. probes for the existence of Magisk, a tool that personal privacy supporters and security scientists use to root their Android devices.
• Geolocation and network profiling exist, suggesting possible tracking capabilities and allowing or disabling of fingerprinting routines by area.
• Hardcoded gadget model lists suggest the application may act in a different way depending on the found hardware.
• Multiple vendor-specific services are used to draw out extra device details. E.g. if it can not figure out the gadget through basic Android SIM lookup (since authorization was not granted), it attempts maker particular extensions to access the exact same details.
  
  Potential Malware-Like Behavior
  
  While no conclusive conclusions can be drawn without dynamic analysis, several observed habits line up with recognized spyware and malware patterns:
  
  - The app uses reflection and UI overlays, which might facilitate unauthorized screen capture or phishing attacks.
• SIM card details, serial numbers, and other device-specific information are aggregated for unknown functions.
• The app executes country-based gain access to constraints and “risk-device” detection, suggesting possible monitoring mechanisms.
• The app carries out calls to fill Dex modules, where additional code is filled from files with a.so extension at runtime.
• The.so files themselves turn around and make additional calls to dlopen(), which can be used to load additional.so files. This facility is not usually checked by Google Play Protect and other static analysis services.
• The.so files can be carried out in native code, such as C++. Making use of native code adds a layer of complexity to the analysis procedure and obscures the full level of the app’s capabilities. Moreover, native code can be leveraged to more easily intensify advantages, potentially making use of vulnerabilities within the os or gadget hardware.
  
  Remarks
  
  While information collection prevails in contemporary applications for annunciogratis.net debugging and improving user experience, aggressive fingerprinting raises substantial personal privacy concerns. The DeepSeek app requires users to visit with a legitimate email, which must currently provide adequate authentication. There is no valid factor for the app to strongly collect and send distinct device identifiers, IMEI numbers, SIM card details, and other non-resettable system homes.
  
  The degree of tracking observed here goes beyond common analytics practices, potentially making it possible for relentless user tracking and re-identification throughout gadgets. These behaviors, combined with obfuscation methods and network interaction with third-party tracking services, require a higher level of scrutiny from security scientists and users alike.
  
  The work of runtime code loading along with the bundling of native code suggests that the app might enable the deployment and execution of unreviewed, from another code. This is a serious prospective attack vector. No proof in this report is presented that remotely released code execution is being done, only that the facility for this appears present.
  
  Additionally, the app’s approach to finding rooted gadgets appears excessive for an AI chatbot. Root detection is frequently justified in DRM-protected streaming services, where security and material security are crucial, or in competitive video games to avoid unfaithful. However, there is no clear rationale for such rigorous procedures in an application of this nature, raising further concerns about its intent.
  
  Users and organizations thinking about setting up DeepSeek must be conscious of these prospective risks. If this application is being used within an enterprise or government environment, additional vetting and security controls need to be enforced before allowing its deployment on handled gadgets.
  
  Disclaimer: The analysis provided in this report is based upon fixed code review and does not indicate that all found functions are actively utilized. Further examination is required for definitive conclusions.