I performed a fixed analysis of DeepSeek, a Chinese LLM chatbot, using version 1.8.0 from the Google Play Store. The objective was to recognize possible security and personal privacy problems.
I have actually composed about DeepSeek previously here.
Additional security and privacy issues about DeepSeek have been raised.
See also this analysis by NowSecure of the iPhone version of DeepSeek
The findings detailed in this report are based purely on fixed analysis. This implies that while the code exists within the app, there is no conclusive proof that all of it is carried out in practice. Nonetheless, the presence of such code warrants scrutiny, especially given the growing issues around information privacy, security, the possible abuse of AI-driven applications, and cyber-espionage dynamics between international powers.
Key Findings
Suspicious Data Handling & Exfiltration
- Hardcoded URLs direct data to external servers, raising issues about user activity tracking, such as to ByteDance "volce.com" endpoints. NowSecure identifies these in the iPhone app yesterday also.
- Bespoke file encryption and information obfuscation approaches exist, forum.pinoo.com.tr with indicators that they might be used to exfiltrate user details.
- The app contains hard-coded public secrets, instead of depending on the user gadget's chain of trust.
- UI interaction tracking records detailed user habits without clear consent.
- WebView manipulation is present, which might permit the app to gain access to personal external web browser data when links are opened. More details about WebView controls is here
Device Fingerprinting & Tracking
A substantial part of the analyzed code appears to focus on gathering device-specific details, which can be utilized for tracking and fingerprinting.
- The app gathers different distinct device identifiers, including UDID, Android ID, IMEI, IMSI, and provider details. - System residential or morphomics.science commercial properties, set up packages, and root detection systems recommend possible anti-tampering steps. E.g. probes for the presence of Magisk, a tool that personal privacy supporters and security researchers utilize to root their Android devices.
- Geolocation and network profiling are present, suggesting possible tracking abilities and making it possible for or disabling of fingerprinting regimes by area.
- Hardcoded gadget model lists recommend the application may behave differently depending on the spotted hardware.
- Multiple are utilized to draw out extra gadget details. E.g. if it can not determine the device through basic Android SIM lookup (since approval was not given), it tries manufacturer specific extensions to access the same details.
Potential Malware-Like Behavior
While no definitive conclusions can be drawn without dynamic analysis, a number of observed behaviors line up with recognized spyware and malware patterns:
- The app utilizes reflection and UI overlays, which might assist in unapproved screen capture or phishing attacks. - SIM card details, serial numbers, and other device-specific information are aggregated for unidentified purposes.
- The app carries out country-based gain access to constraints and "risk-device" detection, recommending possible surveillance mechanisms.
- The app executes calls to load Dex modules, where additional code is filled from files with a.so extension at runtime.
- The.so files themselves reverse and make additional calls to dlopen(), which can be utilized to load additional.so files. This center is not typically examined by Google Play Protect and other fixed analysis services.
- The.so files can be carried out in native code, such as C++. The use of native code adds a layer of intricacy to the analysis procedure and obscures the complete level of the app's capabilities. Moreover, native code can be leveraged to more quickly escalate privileges, potentially making use of vulnerabilities within the os or device hardware.
Remarks
While information collection prevails in modern-day applications for debugging and improving user experience, aggressive fingerprinting raises considerable personal privacy issues. The DeepSeek app needs users to visit with a valid email, which ought to currently provide sufficient authentication. There is no valid reason for the app to strongly collect and send distinct gadget identifiers, IMEI numbers, SIM card details, and other non-resettable system homes.
The extent of tracking observed here exceeds common analytics practices, potentially allowing relentless user tracking and re-identification throughout devices. These habits, integrated with obfuscation methods and network communication with third-party tracking services, necessitate a higher level of examination from security researchers and users alike.
The work of runtime code filling in addition to the bundling of native code suggests that the app could enable the deployment and honkaistarrail.wiki execution of unreviewed, remotely delivered code. This is a serious potential attack vector. No evidence in this report exists that remotely released code execution is being done, only that the facility for this appears present.
Additionally, the app's approach to discovering rooted devices appears excessive for an AI chatbot. Root detection is frequently justified in DRM-protected streaming services, where security and material protection are crucial, or in competitive video games to avoid unfaithful. However, there is no clear reasoning for such rigorous procedures in an application of this nature, raising additional questions about its intent.
Users and organizations thinking about installing DeepSeek ought to understand these potential dangers. If this application is being used within an enterprise or government environment, additional vetting and security controls must be implemented before enabling its deployment on managed gadgets.
Disclaimer: The analysis provided in this report is based on fixed code review and does not indicate that all found functions are actively used. Further investigation is required for definitive conclusions.