1 Static Analysis of The DeepSeek Android App

Adrienne Huff edited this page 2025-02-11 22:00:35 +00:00

I conducted a fixed analysis of DeepSeek, a Chinese LLM chatbot, utilizing version 1.8.0 from the Google Play Store. The objective was to identify possible security and personal privacy problems.

I've discussed DeepSeek formerly here.

Additional security and personal privacy issues about DeepSeek have been raised.

See also this analysis by NowSecure of the iPhone version of DeepSeek

The findings detailed in this report are based purely on static analysis. This implies that while the code exists within the app, there is no conclusive evidence that all of it is carried out in practice. Nonetheless, the existence of such code warrants scrutiny, particularly given the growing issues around information personal privacy, monitoring, the prospective abuse of AI-driven applications, and cyber-espionage characteristics between global powers.

Key Findings

Suspicious Data Handling & Exfiltration

- Hardcoded URLs direct information to external servers, raising concerns about user activity tracking, such as to ByteDance "volce.com" endpoints. NowSecure identifies these in the iPhone app the other day also.

• Bespoke file encryption and wiki.vst.hs-furtwangen.de information obfuscation techniques are present, with indicators that they might be utilized to exfiltrate user details.
• The app contains hard-coded public secrets, rather than relying on the user gadget's chain of trust.
• UI interaction tracking captures detailed user habits without clear permission. - WebView manipulation is present, which could permit the app to gain access to private external internet browser information when links are opened. More details about WebView controls is here
  
  Device Fingerprinting & Tracking
  
  A considerable part of the analyzed code appears to concentrate on event device-specific details, which can be utilized for tracking and fingerprinting.
  
  - The app collects various unique gadget identifiers, including UDID, Android ID, IMEI, IMSI, and provider details.
• System homes, set up packages, and root detection systems recommend possible anti-tampering measures. E.g. probes for the presence of Magisk, a tool that privacy supporters and security scientists utilize to root their Android devices. - Geolocation and network profiling exist, systemcheck-wiki.de indicating possible tracking abilities and making it possible for or disabling of fingerprinting regimes by area. - Hardcoded device design lists recommend the application might act differently depending upon the detected hardware.
• Multiple vendor-specific services are used to extract additional device details. E.g. if it can not identify the device through standard Android SIM lookup (because consent was not approved), it attempts manufacturer specific extensions to access the exact same details.
  
  Potential Malware-Like Behavior
  
  While no definitive conclusions can be drawn without vibrant analysis, numerous observed habits align with known spyware and malware patterns:
  
  - The app utilizes reflection and UI overlays, which could facilitate unapproved screen capture or phishing attacks.
• SIM card details, serial numbers, and other device-specific data are aggregated for unknown functions.
• The app implements country-based gain access to constraints and "risk-device" detection, suggesting possible monitoring mechanisms.
• The app executes calls to load Dex modules, where extra code is packed from files with a.so extension at runtime.
• The.so files themselves turn around and make extra calls to dlopen(), which can be utilized to load additional.so files. This facility is not generally inspected by Google Play Protect and other static analysis services.
• The.so files can be carried out in native code, such as C++. Using native code includes a layer of complexity to the analysis procedure and obscures the complete extent of the app's abilities. Moreover, native code can be leveraged to more quickly intensify benefits, potentially making use of vulnerabilities within the os or device hardware.
  
  Remarks
  
  While data collection prevails in contemporary applications for debugging and enhancing user experience, aggressive fingerprinting raises substantial privacy concerns. The DeepSeek app needs users to log in with a valid email, which ought to currently provide adequate authentication. There is no valid factor for the app to aggressively collect and transfer distinct device identifiers, IMEI numbers, SIM card details, and other non-resettable system properties.
  
  The degree of tracking observed here exceeds common analytics practices, potentially making it possible for relentless user tracking and re-identification across gadgets. These behaviors, combined with obfuscation methods and network communication with third-party tracking services, call for a higher level of examination from security researchers and users alike.
  
  The work of runtime code filling in addition to the bundling of native code suggests that the app might allow the release and execution of unreviewed, remotely provided code. This is a serious possible attack vector. No evidence in this report is presented that from another location released code execution is being done, only that the center for this appears present.
  
  Additionally, the to detecting rooted gadgets appears excessive for an AI chatbot. Root detection is often warranted in DRM-protected streaming services, where security and content security are important, or in competitive computer game to avoid unfaithful. However, there is no clear rationale for such strict procedures in an application of this nature, raising more questions about its intent.
  
  Users and organizations considering installing DeepSeek needs to be conscious of these possible dangers. If this application is being used within a business or federal government environment, additional vetting and security controls need to be imposed before allowing its implementation on handled gadgets.
  
  Disclaimer: The analysis provided in this report is based on static code review and does not imply that all identified functions are actively used. Further examination is required for conclusive conclusions.