Experts Flag Security, Privacy Risks in Deep Seek AI App
Summary: DeepSeek's iOS app, among the top three free downloads on Apple and Google since its January 25, 2025 debut, disables iOS App Transport Security and sends device information unencrypted, uses the deprecated 3DES algorithm with a hard-coded key, and communicates with ByteDance's Volcengine cloud platform. NowSecure urged organizations to remove the iOS app, while the House of Representatives restricted it on House-issued devices, and Italy, Taiwan, the Pentagon, NASA, and the U.S. Navy moved to block or ban it.
Bottom line: A hard-coded key in a shipped app means anyone who extracts it can read the fields it was meant to protect, and the app's device fingerprinting combined with IP address and ad-network data can deanonymize users. Separately, Wiz found a publicly accessible DeepSeek database exposing chat history, API secrets, and log streams with no authentication.
Read the original at Krebs on Security ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026