1 Static Analysis of The DeepSeek Android App

Abbie Santo edited this page 2 months ago

I performed a static analysis of DeepSeek, a Chinese LLM chatbot, utilizing version 1.8.0 from the Google Play Store. The objective was to identify potential security and privacy problems.

I've composed about DeepSeek formerly here.

Additional security and privacy about DeepSeek have actually been raised.

See also this analysis by NowSecure of the iPhone version of DeepSeek

The findings detailed in this report are based simply on static analysis. This indicates that while the code exists within the app, there is no conclusive proof that all of it is carried out in practice. Nonetheless, classifieds.ocala-news.com the presence of such code warrants examination, specifically offered the growing concerns around information personal privacy, monitoring, the prospective misuse of AI-driven applications, and cyber-espionage dynamics in between global powers.

Key Findings

Suspicious Data Handling & Exfiltration

- Hardcoded URLs direct information to external servers, raising issues about user activity monitoring, such as to ByteDance "volce.com" endpoints. NowSecure identifies these in the iPhone app the other day as well. - Bespoke encryption and information obfuscation methods are present, with signs that they could be used to exfiltrate user details.

• The app contains hard-coded public secrets, instead of depending on the user gadget's chain of trust.
• UI interaction tracking catches detailed user behavior without clear approval.
• WebView adjustment exists, which might allow for the app to gain access to private external browser data when links are opened. More details about WebView controls is here
  
  Device Fingerprinting & Tracking
  
  A substantial part of the examined code appears to focus on gathering device-specific details, which can be utilized for tracking and fingerprinting.
  
  - The app gathers numerous special gadget identifiers, consisting of UDID, Android ID, IMEI, IMSI, and provider details.
• System properties, set up bundles, and root detection systems recommend potential anti-tampering steps. E.g. probes for the existence of Magisk, a tool that privacy advocates and security researchers utilize to root their Android devices.
• Geolocation and network profiling are present, indicating potential tracking abilities and enabling or disabling of fingerprinting regimes by area.
• Hardcoded device model lists recommend the application might act differently depending on the discovered hardware.
• Multiple vendor-specific services are utilized to extract additional gadget details. E.g. if it can not figure out the gadget through standard Android SIM lookup (because consent was not given), it tries producer specific extensions to access the very same details.
  
  Potential Malware-Like Behavior
  
  While no definitive conclusions can be drawn without vibrant analysis, numerous observed behaviors align with known spyware and malware patterns:
  
  - The app utilizes reflection and UI overlays, which could help with unauthorized screen capture or phishing attacks.
• SIM card details, serial numbers, and other device-specific information are aggregated for it-viking.ch unknown functions.
• The app implements country-based gain access to constraints and "risk-device" detection, suggesting possible monitoring mechanisms.
• The app carries out calls to fill Dex modules, where extra code is loaded from files with a.so extension at runtime.
• The.so submits themselves reverse and make additional calls to dlopen(), which can be utilized to pack additional.so files. This facility is not typically examined by Google Play Protect and other fixed analysis services.
• The.so files can be carried out in native code, bbarlock.com such as C++. Using native code adds a layer of complexity to the analysis process and obscures the complete extent of the app's abilities. Moreover, angevinepromotions.com native code can be leveraged to more quickly escalate privileges, potentially exploiting vulnerabilities within the os or wiki.snooze-hotelsoftware.de gadget hardware.
  
  Remarks
  
  While data collection prevails in modern applications for debugging and improving user experience, aggressive fingerprinting raises substantial personal privacy issues. The DeepSeek app requires users to log in with a legitimate email, which ought to already provide adequate authentication. There is no legitimate reason for the app to strongly collect and transmit distinct gadget identifiers, IMEI numbers, SIM card details, and other non-resettable system homes.
  
  The extent of tracking observed here exceeds normal analytics practices, potentially making it possible for persistent user tracking and re-identification across devices. These behaviors, combined with obfuscation strategies and network communication with third-party tracking services, call for a higher level of examination from security scientists and users alike.
  
  The work of runtime code packing as well as the bundling of native code recommends that the app might allow the deployment and execution of unreviewed, from another location provided code. This is a severe possible attack vector. No proof in this report is provided that from another location released code execution is being done, only that the center for forum.pinoo.com.tr this appears present.
  
  Additionally, the app's method to finding rooted gadgets appears extreme for an AI chatbot. Root detection is frequently warranted in DRM-protected streaming services, where security and content security are crucial, or in competitive computer game to prevent unfaithful. However, there is no clear rationale for such strict measures in an application of this nature, raising further concerns about its intent.
  
  Users and tandme.co.uk organizations thinking about setting up DeepSeek should know these potential dangers. If this application is being utilized within an enterprise or government environment, extra vetting and security controls ought to be imposed before permitting its implementation on handled devices.
  
  Disclaimer: The analysis presented in this report is based on static code evaluation and does not imply that all detected functions are actively used. Further investigation is required for definitive conclusions.