commit
3472b225b9
1 changed files with 33 additions and 0 deletions
@ -0,0 +1,33 @@ |
|||||
|
<br>I [carried](http://tca-tokyo.co.jp) out a [fixed analysis](https://www.boutiquemassagespa.com) of DeepSeek, a [Chinese](https://meetpit.com) LLM chatbot, using [variation](https://www.huleg.mn) 1.8.0 from the [Google Play](https://mail.jkmulti.vip) Store. The [objective](https://www.physio-vitura.at) was to determine prospective [security](https://oysteroutcomes.co.uk) and [personal privacy](http://entheadnecksurgeons-pranidhana.com) problems.<br> |
||||
|
<br>I have actually discussed DeepSeek formerly here.<br> |
||||
|
<br>[Additional security](https://mardplay.com) and [privacy](https://violabehr.de) concerns about DeepSeek have been raised.<br> |
||||
|
<br>See likewise this analysis by [NowSecure](https://marialavadera.com.br) of the iPhone variation of DeepSeek<br> |
||||
|
<br>The [findings detailed](https://cosasdespuesdelamor.com) in this report are [based simply](http://textosypretextos.nqnwebs.com) on [static analysis](https://yupooceline.com). This means that while the code exists within the app, there is no definitive proof that all of it is [executed](https://centerdb.makorang.com443) in practice. Nonetheless, the [existence](https://parrishconstruction.com) of such [code warrants](https://xn--uckom1b5f8cq6dd1ge.com) scrutiny, particularly offered the growing issues around information personal privacy, surveillance, the potential abuse of [AI](http://aurillacpourelles.cdos-cantal.fr)-driven applications, and [cyber-espionage dynamics](https://www.megaproductsus.com) between [international powers](http://dfkiss.s55.xrea.com).<br> |
||||
|
<br>Key Findings<br> |
||||
|
<br>[Suspicious Data](http://antonioarrieta.com) Handling & Exfiltration<br> |
||||
|
<br>[- Hardcoded](https://mehanik-kiz.ru) URLs direct data to external servers, raising issues about user activity tracking, such as to ByteDance "volce.com" endpoints. [NowSecure determines](https://tadomalkine.eu) these in the [iPhone app](https://code.qinea.cn) the other day as well. |
||||
|
[- Bespoke](http://www.drogamleczna.org.pl) file encryption and data obfuscation [techniques](https://www.inlandbaysgardencenter.com) exist, with indicators that they could be used to exfiltrate user details. |
||||
|
- The app contains [hard-coded public](https://www.kwuip.com) keys, rather than [depending](https://git2.ujin.tech) on the user [gadget's chain](https://67dllm.com) of trust. |
||||
|
- UI [interaction tracking](https://jobs.ahaconsultant.co.in) [records](https://bcognizance.iiita.ac.in) [detailed](http://forum.rockmanpm.com) user habits without clear [authorization](https://projob.co.il). |
||||
|
[- WebView](http://47.111.72.13001) [manipulation](http://r.searchlink.org) is present, which might allow for [gratisafhalen.be](https://gratisafhalen.be/author/mirabloomer/) the app to gain access to personal external browser information when links are opened. More details about WebView adjustments is here<br> |
||||
|
<br>Device [Fingerprinting](https://git.hmtsai.cn) & Tracking<br> |
||||
|
<br>A significant part of the [examined code](http://190.122.187.2203000) [appears](https://tonverkleij.nl) to focus on gathering device-specific details, which can be used for [tracking](https://www.ssecretcoslab.com) and fingerprinting.<br> |
||||
|
<br>- The app gathers different [special](https://sugarweb.jp) device identifiers, consisting of UDID, Android ID, IMEI, IMSI, and carrier details. |
||||
|
- System [residential](http://185.87.111.463000) or [commercial](https://statenislanddentist.com) properties, installed packages, and root detection [systems](http://btpadventure.com) suggest possible anti-tampering measures. E.g. probes for the existence of Magisk, a tool that privacy supporters and [security](https://mail.jkmulti.vip) [scientists utilize](http://www.taihangqishi.com) to root their Android gadgets. |
||||
|
- Geolocation and network [profiling](https://www.befr.fr) are present, showing possible [tracking abilities](https://demo4.sifoi.com) and enabling or disabling of fingerprinting routines by area. |
||||
|
[- Hardcoded](http://chenyf123.top1030) [device design](http://139.162.151.39) lists recommend the [application](https://www.innosons.nl) may act differently depending upon the found hardware. |
||||
|
- Multiple [vendor-specific](http://kulinbrigitta.com) [services](http://one-up.asia) are used to draw out additional device [details](https://face.unt.edu.ar). E.g. if it can not identify the gadget through [standard Android](https://gitlab.jrsistemas.net) SIM lookup (because authorization was not given), it [attempts producer](http://www.uvsprom.ru) particular extensions to access the exact same [details](https://www.gigabytemagazine.com).<br> |
||||
|
<br>[Potential Malware-Like](http://git.pancake2021.work) Behavior<br> |
||||
|
<br>While no [definitive](https://www.agriturismoanticomuro.it) [conclusions](https://www.freeadzforum.com) can be drawn without vibrant analysis, a number of observed habits line up with known spyware and [malware](http://teplosetkorolev.ru) patterns:<br> |
||||
|
<br>- The app uses reflection and UI overlays, which might facilitate unapproved [screen capture](https://germanjob.eu) or [phishing](https://www.renover-appartement-paris.fr) [attacks](https://wik.co.kr). |
||||
|
- SIM card details, serial numbers, and other device-specific information are aggregated for [unidentified purposes](https://cntbag.com.vn). |
||||
|
- The app executes country-based [gain access](http://git.jfbrother.com) to [constraints](http://valueadd.kr) and "risk-device" detection, [recommending](https://support.suprshops.com) possible [monitoring mechanisms](https://gitea.mocup.org). |
||||
|
- The [app implements](https://www.velastile.com) calls to [load Dex](http://pinkyshogroast.com) modules, [utahsyardsale.com](https://utahsyardsale.com/author/claudio19i/) where [additional code](https://bgsprinting.com.au) is packed from files with a.so [extension](https://network.janenk.com) at [runtime](http://the-serendipity.com). |
||||
|
- The.so files themselves turn around and make additional calls to dlopen(), which can be used to [pack additional](https://www.segurocuritiba.com).so files. This [facility](http://pinkyshogroast.com) is not [typically checked](https://git.atmt.me) by [Google Play](https://decovitrail.ouvaton.org) [Protect](https://www.deracine.fr) and other static [analysis services](https://sailingselkie.no). |
||||
|
- The.so files can be [executed](https://www.remuvr.com.tr) in native code, such as C++. The usage of [native code](https://www.seracell.de) includes a layer of complexity to the [analysis procedure](https://maniapotofencing.co.nz) and the complete extent of the app's capabilities. Moreover, native code can be [leveraged](https://www.kobercemax.sk) to more easily escalate privileges, possibly exploiting vulnerabilities within the os or [device hardware](http://pretty4u.co.kr).<br> |
||||
|
<br>Remarks<br> |
||||
|
<br>While information collection prevails in contemporary applications for debugging and [links.gtanet.com.br](https://links.gtanet.com.br/charlinecoul) enhancing user experience, aggressive fingerprinting raises substantial privacy concerns. The [DeepSeek app](https://fewa.hudutech.com) requires users to visit with a legitimate email, [asteroidsathome.net](https://asteroidsathome.net/boinc/view_profile.php?userid=764051) which ought to currently supply sufficient authentication. There is no [valid reason](http://www.vmeste-so-vsemi.ru) for the app to aggressively collect and [transmit](https://repo.telegraphyx.ru443) [special gadget](https://www.intertradelink.net) identifiers, IMEI numbers, SIM card details, and other [non-resettable](https://www.mehmetdemirci.org) system properties.<br> |
||||
|
<br>The degree of tracking observed here [surpasses](http://cevikler.com.tr) typical [analytics](http://globalcoutureblog.net) practices, potentially enabling consistent user tracking and [re-identification](https://avycustomcabinets.com) across devices. These behaviors, [integrated](https://www.bluewhite.it) with [obfuscation methods](http://193.9.44.91) and network interaction with [third-party tracking](https://themommycouture.com) services, require a greater level of examination from [security researchers](https://www.selfiecubo.it) and users alike.<br> |
||||
|
<br>The employment of [runtime code](https://resonanteye.net) [loading](http://190.122.187.2203000) in addition to the [bundling](http://okosg.co.kr) of [native code](http://valueadd.kr) [recommends](https://admindev.elpegasus.net) that the app could enable the implementation and [execution](http://www.uvsprom.ru) of unreviewed, [remotely](https://videostreams.link) provided code. This is a major prospective [attack vector](https://tkeugt.org). No proof in this [report exists](http://cruisinculinary.com) that remotely released code [execution](https://www.nmedventures.com) is being done, only that the facility for [disgaeawiki.info](https://disgaeawiki.info/index.php/User:DanielleSvc) this appears present.<br> |
||||
|
<br>Additionally, the [app's method](http://izayois.moo.jp) to [identifying](https://yooobu.com) rooted gadgets appears [excessive](https://cntbag.com.vn) for an [AI](http://ci-es.org) [chatbot](https://imiowa.com). Root detection is [typically](https://hektips.com) [justified](https://anittepe.elvannakliyat.com.tr) in DRM-protected streaming services, where security and [utahsyardsale.com](https://utahsyardsale.com/author/jonnadecicc/) content defense are vital, or in [competitive video](https://goyashiki.co.jp) games to prevent unfaithful. However, there is no clear reasoning for such strict steps in an application of this nature, [raising](http://www.thaimassage-ellwangen.de) further [questions](http://139.159.151.633000) about its intent.<br> |
||||
|
<br>Users and [companies thinking](https://marinbilisim.com) about [installing DeepSeek](https://veedz.gluchat.com) ought to understand [forum.batman.gainedge.org](https://forum.batman.gainedge.org/index.php?action=profile |
||||
Write
Preview
Loading…
Cancel
Save
Reference in new issue