Tag: analysis

I think by now everyone in the tech industry already knows about DeepSeek: it’s the new mold-breaking, disruptive Large Language Model (LLM) from the Chinese company of the same name. It achieves good performance, and the company claims to have trained it for a tiny fraction of the cost of the top LLMs. Certainly, it’s svelte enough to run a version of it on an Android device.

There have been security concerns from the start, and a few countries have banned or restricted its use, including Italy, Australia, and the United States Navy.

SecurityScorecard’s STRIKE team has performed in-depth analysis of DeepSeek, and their results are mixed. Their key findings:

• The DeepSeek Android app has security vulnerabilities, such as weak encryption, SQL injection risks, and hardcoded keys.
• It has a broad data collection scope, including user inputs, device data, and keystroke patterns, stored in China.
• There are concerns about data transmission to Chinese state-owned entities and ByteDance.
• The app employs anti-debugging mechanisms.
• DeepSeek has faced regulatory scrutiny and bans in multiple countries.
• Code analysis reveals integration with ByteDance‘s services.
• The app requests permissions for internet access, phone state, and location.
• Third-party domains that the app connects to, like Ktor, have failing security scores, which raises business risks related to data security.
• Despite security weaknesses and  privacy concerns, no overtly malicious behavior was detected.

I think a lot of these are unsurprising: DeepSeek was up front about their data being stored within the People’s Republic of China. The requests for permissions that the app doesn’t really need are almost standard these days, and if Google did it (they do), we wouldn’t think twice.

Of concern to me is their poor security practices in general, combined with collecting potentially quite private data. As STRIKE points out, it’s weird to use anti-debugging mechanisms, especially for a company claiming to be transparent.

I don’t think this analysis is going to change anyone’s opinion of DeepSeek: it was widely criticized as a security risk before, just on the basis of sending information to China. Lax security within the app is probably not a big deal compared to that, but it does potentially mean that your data might be exposed to other entities as well.

---

I promise: next time I’ll write about something other than SecurityScorecard. I came across this one while reading the previous report, and I wanted to see what they had to say.