denisemcnally

harrisdymock53/denisemcnally

I conducted a static analysis of DeepSeek, a Chinese LLM chatbot, photorum.eclat-mauve.fr utilizing variation 1.8.0 from the Google Play Store. The goal was to recognize potential security and privacy issues.

I've discussed DeepSeek formerly here.

Additional security and privacy concerns about DeepSeek have been raised.

See likewise this analysis by NowSecure of the iPhone version of DeepSeek

The findings detailed in this report are based purely on static analysis. This indicates that while the code exists within the app, there is no definitive evidence that all of it is carried out in practice. Nonetheless, the presence of such code warrants analysis, particularly given the growing concerns around data personal privacy, security, the prospective abuse of AI -driven applications, and cyber-espionage characteristics between worldwide powers.

Key Findings

Suspicious Data Handling & Exfiltration

- Hardcoded URLs direct data to external servers, raising concerns about user activity tracking, such as to ByteDance "volce.com" endpoints. NowSecure recognizes these in the iPhone app the other day too. - Bespoke file encryption and information obfuscation methods exist, with indications that they might be utilized to exfiltrate user details.

The app contains hard-coded public keys, rather than counting on the user device's chain of trust.
UI interaction tracking captures detailed user habits without clear authorization. - WebView adjustment exists, which could permit the app to gain access to personal external internet browser information when links are opened. More details about WebView controls is here

Device Fingerprinting & Tracking

A significant portion of the examined code appears to focus on details, which can be used for suvenir51.ru tracking and fingerprinting.

- The app collects numerous special device identifiers, including UDID, Android ID, IMEI, IMSI, and provider details.
System residential or commercial properties, set up bundles, and root detection mechanisms recommend potential anti-tampering measures. E.g. probes for the presence of Magisk, a tool that privacy advocates and security researchers utilize to root their Android devices.
Geolocation and network profiling are present, showing possible tracking abilities and making it possible for or disabling of fingerprinting regimes by area. - Hardcoded device model lists suggest the application may behave in a different way depending on the identified hardware.
Multiple vendor-specific services are used to extract additional gadget details. E.g. if it can not figure out the device through basic Android SIM lookup (due to the fact that permission was not given), it attempts producer specific extensions to access the same details.

Potential Malware-Like Behavior

While no conclusive conclusions can be drawn without dynamic analysis, numerous observed habits line up with known spyware and malware patterns:

- The app uses reflection and UI overlays, morphomics.science which might facilitate unauthorized screen capture or phishing attacks.
SIM card details, serial numbers, and other device-specific information are aggregated for unknown purposes.
The app carries out country-based gain access to constraints and "risk-device" detection, recommending possible security mechanisms.
The app implements calls to fill Dex modules, where additional code is packed from files with a.so extension at runtime.
The.so files themselves reverse and experienciacortazar.com.ar make extra calls to dlopen(), which can be utilized to fill additional.so files. This facility is not typically examined by Google Play Protect and other fixed analysis services.
The.so files can be executed in native code, such as C++. The usage of native code adds a layer of intricacy to the analysis procedure and obscures the complete extent of the app's capabilities. Moreover, native code can be leveraged to more quickly escalate privileges, potentially exploiting vulnerabilities within the operating system or gadget hardware.

Remarks

While information collection prevails in modern applications for debugging and enhancing user experience, aggressive fingerprinting raises substantial privacy issues. The DeepSeek app needs users to log in with a legitimate email, which need to already provide enough authentication. There is no legitimate reason for the app to strongly gather and transmit distinct device identifiers, IMEI numbers, SIM card details, and other non-resettable system properties.

The extent of tracking observed here goes beyond normal analytics practices, potentially allowing relentless user tracking and re-identification across devices. These behaviors, combined with obfuscation techniques and network interaction with third-party tracking services, require a greater level of analysis from security scientists and users alike.

The employment of runtime code filling in addition to the bundling of native code recommends that the app could allow the deployment and execution of unreviewed, wiki.vst.hs-furtwangen.de from another location delivered code. This is a serious potential attack vector. No evidence in this report is presented that remotely deployed code execution is being done, only that the center for this appears present.

Additionally, the app's approach to identifying rooted devices appears excessive for an AI chatbot. Root detection is often justified in DRM-protected streaming services, where security and material defense are critical, or in competitive video games to avoid unfaithful. However, there is no clear rationale for such rigorous steps in an application of this nature, raising further concerns about its intent.

Users and companies considering installing DeepSeek should be mindful of these possible dangers. If this application is being used within an enterprise or government environment, additional vetting and security controls must be enforced before allowing its deployment on managed devices.

Disclaimer: The analysis provided in this report is based on fixed code evaluation and does not suggest that all detected functions are actively used. Further examination is required for elclasificadomx.com conclusive conclusions.