I carried out a fixed analysis of DeepSeek, a Chinese LLM chatbot, using version 1.8.0 from the Google Play Store. The objective was to determine possible security and personal privacy issues.

I've written about DeepSeek formerly here.

Additional security and personal privacy concerns about DeepSeek have been raised.

See likewise this analysis by NowSecure of the iPhone variation of DeepSeek

The findings detailed in this report are based simply on static analysis. This indicates that while the code exists within the app, hb9lc.org there is no definitive evidence that all of it is executed in practice. Nonetheless, the existence of such code warrants scrutiny, particularly offered the growing issues around data personal privacy, security, the possible misuse of AI-driven applications, and cyber-espionage dynamics between global powers.

Key Findings

Suspicious Data Handling & Exfiltration

- Hardcoded URLs direct information to external servers, raising issues about user activity tracking, such as to ByteDance "volce.com" endpoints. NowSecure determines these in the iPhone app the other day as well. - Bespoke file encryption and information obfuscation approaches are present, with indications that they might be utilized to exfiltrate user details.

• The app contains hard-coded public keys, instead of counting on the user device's chain of trust.
• UI interaction tracking records detailed user habits without clear permission. - WebView manipulation exists, which might enable for the app to gain access to private external internet browser data when links are opened. More details about WebView controls is here
  
  Device Fingerprinting & Tracking
  
  A substantial part of the analyzed code appears to concentrate on gathering device-specific details, which can be used for tracking and fingerprinting.
  
  - The app collects different unique gadget identifiers, including UDID, Android ID, IMEI, IMSI, and provider details.
• System homes, installed bundles, and root detection systems recommend prospective anti-tampering steps. E.g. probes for the presence of Magisk, a tool that personal privacy supporters and security researchers utilize to root their Android gadgets.
• Geolocation and hb9lc.org network profiling are present, indicating possible tracking abilities and enabling or disabling of fingerprinting routines by area.
• Hardcoded gadget design lists suggest the application might behave differently depending upon the identified hardware. - Multiple vendor-specific services are used to draw out additional device details. E.g. if it can not determine the gadget through standard Android SIM lookup (because consent was not granted), it attempts producer particular extensions to access the same details.
  
  Potential Malware-Like Behavior
  
  While no definitive conclusions can be drawn without dynamic analysis, numerous observed behaviors line up with recognized spyware and malware patterns:
  
  - The app uses reflection and UI overlays, which might assist in unapproved screen capture or phishing attacks.
• SIM card details, identification numbers, and other device-specific data are aggregated for unknown functions.
• The app carries out country-based gain access to constraints and "risk-device" detection, suggesting possible security mechanisms.
• The app implements calls to pack Dex modules, where additional code is filled from files with a.so extension at runtime.
• The.so files themselves turn around and make extra calls to dlopen(), which can be used to pack additional.so files. This center is not generally examined by Google Play Protect and other fixed analysis services.
• The.so files can be carried out in native code, such as C++. Making use of native code includes a layer of intricacy to the analysis procedure and obscures the complete extent of the app's abilities. Moreover, native code can be leveraged to more easily escalate privileges, possibly making use of vulnerabilities within the operating system or gadget hardware.
  
  Remarks
  
  While data collection prevails in modern-day applications for debugging and enhancing user experience, aggressive fingerprinting raises substantial personal privacy issues. The DeepSeek app requires users to log in with a legitimate email, which must currently provide adequate authentication. There is no valid factor for the app to aggressively collect and transfer unique gadget identifiers, IMEI numbers, SIM card details, and other non-resettable system residential or commercial properties.
  
  The degree of tracking observed here surpasses common analytics practices, potentially enabling persistent user tracking and re-identification across gadgets. These habits, integrated with obfuscation strategies and network interaction with third-party tracking services, call for a greater level of scrutiny from security scientists and users alike.
  
  The work of runtime code filling as well as the bundling of native code recommends that the app could permit the release and execution of unreviewed, remotely provided code. This is a severe potential attack vector. No evidence in this report is presented that from another location released code execution is being done, only that the center for this appears present.
  
  Additionally, the app's method to identifying rooted gadgets appears extreme for an AI chatbot. Root detection is frequently justified in DRM-protected streaming services, where security and content protection are critical, or in competitive computer game to prevent unfaithful. However, there is no clear rationale for such rigorous measures in an application of this nature, raising more concerns about its intent.
  
  Users and companies considering setting up DeepSeek should be conscious of these potential dangers. If this application is being used within a business or government environment, extra vetting and security controls must be enforced before enabling its release on managed gadgets.
  
  Disclaimer: The analysis presented in this report is based on evaluation and does not imply that all spotted functions are actively used. Further examination is required for definitive conclusions.