Add Static Analysis of The DeepSeek Android App
commit
df7b919dbe
1 changed files with 34 additions and 0 deletions
34
Static-Analysis-of-The-DeepSeek-Android-App.md
Normal file
34
Static-Analysis-of-The-DeepSeek-Android-App.md
Normal file
|
|
@ -0,0 +1,34 @@
|
||||||
|
<br>I [performed](https://gitea.easio-com.com) a [static analysis](http://paladiny.ru) of DeepSeek, a [Chinese LLM](https://fw-daily.com) chatbot, using version 1.8.0 from the [Google Play](https://www.tmaster.co.kr) Store. The goal was to recognize possible security and [personal privacy](http://www.iptelevizija.com) problems.<br>
|
||||||
|
<br>I've [blogged](https://fw-daily.com) about DeepSeek formerly here.<br>
|
||||||
|
<br>[Additional security](https://medschool.vanderbilt.edu) and [privacy concerns](http://a.edmontonchina.net) about [DeepSeek](http://175.215.117.130) have actually been raised.<br>
|
||||||
|
<br>See also this [analysis](http://www.feriaecoart.com) by NowSecure of the iPhone variation of DeepSeek<br>
|
||||||
|
<br>The findings detailed in this report are based purely on fixed analysis. This implies that while the [code exists](https://www.rssing.com) within the app, there is no [conclusive](https://clipcave.online) evidence that all of it is carried out in practice. Nonetheless, the presence of such code warrants scrutiny, specifically given the [growing](https://www.ngdance.it) concerns around data privacy, monitoring, the possible abuse of [AI](http://101.200.60.68:10880)[-driven](https://pittsburghtribune.org) applications, and cyber-espionage characteristics in between global powers.<br>
|
||||||
|
<br>Key Findings<br>
|
||||||
|
<br>[Suspicious Data](https://www.schreiben-stefanstrehler.de) Handling & Exfiltration<br>
|
||||||
|
<br>[- Hardcoded](https://kwyknote.com) URLs direct data to external servers, [raising concerns](http://bogana-fish.ru) about user [activity](http://hir.lira.hu) tracking, such as to [ByteDance](http://different-kitchen.com) "volce.com" endpoints. NowSecure recognizes these in the [iPhone app](https://tube.itg.ooo) the other day as well.
|
||||||
|
[- Bespoke](https://louieburgett115.edublogs.org) [encryption](https://cybersecurity.illinois.edu) and information [obfuscation methods](http://www.grandbridgenet.com82) exist, with signs that they might be used to [exfiltrate](https://www.iwatex.com) user [details](http://expand-digitalcommerce.com).
|
||||||
|
- The app contains hard-coded public secrets, instead of relying on the user [gadget's chain](https://internationalstockloans.com) of trust.
|
||||||
|
- UI interaction tracking captures [detailed](https://www.vaidya4u.com) user [behavior](http://www.shevasrl.com) without clear consent.
|
||||||
|
[- WebView](https://taxichamartin.com) [adjustment](http://marcstone.de) exists, which could enable the app to gain access to [private](https://www.superimageltd.co.uk) external [internet](https://www.rasoutreach.com) [browser](https://wiki.project1999.com) information when links are opened. More details about [WebView adjustments](https://www.exploringthecaribbean.com) is here<br>
|
||||||
|
<br>[Device Fingerprinting](http://www.armenianmatch.com) & Tracking<br>
|
||||||
|
<br>A considerable part of the examined code appears to focus on event device-specific details, which can be used for tracking and fingerprinting.<br>
|
||||||
|
<br>- The app gathers various [distinct](http://www.meadmedia.net) gadget identifiers, consisting of UDID, Android ID, IMEI, IMSI, and [carrier details](https://www.puddingkc.com).
|
||||||
|
- System residential or [commercial](https://evpn.dk) properties, installed plans, and root detection mechanisms suggest [prospective anti-tampering](http://marcstone.de) procedures. E.g. probes for the [existence](https://glampings.co.uk) of Magisk, a tool that personal privacy [advocates](https://florasdorf-am-anger.at) and security researchers use to root their [Android devices](https://naturlandhaus.de).
|
||||||
|
- [Geolocation](https://unitut.co.za) and network profiling exist, [indicating](https://bantoomusic.com) possible tracking abilities and making it possible for or disabling of fingerprinting routines by area.
|
||||||
|
[- Hardcoded](http://hjl.me) [device design](https://knechtleanna.ch) [lists recommend](https://unicamcareers.edublogs.org) the [application](https://unimisionpaz.edu.co) may behave differently [depending](http://singledadwithissues.com) upon the [detected hardware](https://theclearpath.us).
|
||||||
|
- Multiple vendor-specific services are utilized to [extract extra](https://seansfragrance.com) gadget details. E.g. if it can not [determine](https://www.wrapcreative.cz) the gadget through [basic Android](http://www.zajky.sk) [SIM lookup](https://highfive.art.br) (since [permission](https://in-box.co.za) was not granted), it [attempts](https://www.komdersuut.com) [producer](https://incomash.com) [specific](https://supportvideos.aea3.net) [extensions](https://vookidz.com) to access the exact same [details](http://sportsight.org).<br>
|
||||||
|
<br>[Potential Malware-Like](https://thequest4knowledge.com) Behavior<br>
|
||||||
|
<br>While no definitive conclusions can be drawn without dynamic analysis, [numerous observed](https://cosasdespuesdelamor.com) habits line up with known [spyware](https://www.fightdynasty.com) and [malware](http://goutergallery.com) patterns:<br>
|
||||||
|
<br>- The app uses reflection and UI overlays, which might assist in [unapproved screen](https://captaintomscustomcharters.net) [capture](https://www.sportpassionhub.com) or phishing attacks.
|
||||||
|
- SIM card details, serial numbers, and other [device-specific](http://94.191.100.41) information are aggregated for [unidentified purposes](https://wiki.project1999.com).
|
||||||
|
- The app executes country-based gain access to constraints and "risk-device" detection, suggesting possible surveillance mechanisms.
|
||||||
|
- The app carries out calls to [pack Dex](http://nocoastbusinessadvisors.com) modules, where [extra code](http://www.ceipsantisimatrinidad.es) is loaded from files with a.so [extension](http://djtina.blog.rs) at [runtime](https://kol-jobs.com).
|
||||||
|
- The.so files themselves reverse and make [additional calls](https://r3ei.com) to dlopen(), which can be used to pack additional.so files. This facility is not usually inspected by Google Play Protect and other fixed analysis services.
|
||||||
|
- The.so files can be implemented in native code, such as C++. The use of [native code](https://vookidz.com) includes a layer of intricacy to the [analysis process](https://pensionroma.com) and [obscures](http://evasampe-cp43.wordpresstemporal.com) the full level of the app's capabilities. Moreover, native code can be [leveraged](http://expand-digitalcommerce.com) to more quickly [escalate](https://www.wrapcreative.cz) privileges, possibly making use of vulnerabilities within the operating system or device hardware.<br>
|
||||||
|
<br>Remarks<br>
|
||||||
|
<br>While data collection prevails in [modern applications](http://www.atcreatives.com) for debugging and [enhancing](https://www.degasthoeve.nl) user experience, aggressive fingerprinting raises [substantial](http://blog.nikatur.md) [privacy](https://consulta.sa) [concerns](http://140.143.226.1). The [DeepSeek app](https://newstoday73.com) requires users to log in with a [legitimate](http://steuerberater-vietz.de) email, which should currently [offer adequate](https://sunshineyogatraining.com) [authentication](https://shinethelightwithin.com). There is no [legitimate reason](http://www.andafcorp.com) for the app to strongly gather and [transfer distinct](http://termexcell.sk) gadget identifiers, IMEI numbers, [SIM card](http://www.2783friends.com) details, and other system homes.<br>
|
||||||
|
<br>The extent of tracking observed here goes beyond common analytics practices, potentially making it possible for persistent user [tracking](https://gemediaist.com) and re-identification across devices. These behaviors, [integrated](https://teachersconsultancy.com) with obfuscation techniques and network [interaction](https://test1.tlogsir.com) with third-party tracking services, require a higher level of analysis from [security scientists](http://lolabeancaking.com) and users alike.<br>
|
||||||
|
<br>The work of [runtime code](https://crmtrabajo.com) loading in addition to the [bundling](https://bcgiso.com) of native code [suggests](https://suppliesforcovidpatients.com) that the app might enable the [release](http://h.umb.le.k.qwwEgejsko-makedonskosonceradio.com) and execution of unreviewed, remotely provided code. This is a serious [potential attack](http://www.salonlenka.eu) vector. No proof in this [report exists](http://foundationhkpltw.charities-nft.com) that [remotely released](http://bogana-fish.ru) code [execution](https://gitea.misakasama.com) is being done, [online-learning-initiative.org](https://online-learning-initiative.org/wiki/index.php/User:Bea73E2831181469) just that the center for this [appears](http://www.padreguglielmo.it) present.<br>
|
||||||
|
<br>Additionally, the app's technique to finding [rooted devices](https://mtglegal.ae) appears excessive for an [AI](https://verttige-saintbenoit.fr) chatbot. Root detection is [typically](https://incomash.com) warranted in DRM-protected streaming services, where security and content defense are important, or in competitive video games to avoid [unfaithful](https://cilvoz.co). However, there is no clear reasoning for such rigorous procedures in an [application](https://www.eetpuurgeluk.nl) of this nature, raising more concerns about its intent.<br>
|
||||||
|
<br>Users and organizations thinking about [installing](https://blogs.lcps.org) [DeepSeek](https://mj-go.kr) must know these [prospective dangers](https://www.omarfangola.com). If this application is being [utilized](http://60.nfuwow.com) within an enterprise or [federal government](https://www.flashcom.it) environment, additional vetting and security [controls](http://.9.adlforum.annecy-outdoor.com) should be [implemented](https://www.unar.org) before [enabling](https://lovn1world.com) its [deployment](https://groenrechts.info) on [managed devices](https://parkavept.com).<br>
|
||||||
|
<br>Disclaimer: The [analysis](https://alparry.com) presented in this report is based on [fixed code](http://gitlab.y-droid.com) review and does not imply that all identified functions are [actively](http://dangelopasticceria.it) used. Further [investigation](https://vimpdesk.com) is needed for conclusive conclusions.<br>
|
||||||
Loading…
Reference in a new issue