DeepSeek iOS App Security Flaws Exposed: Major Privacy Risks 2025

DeepSeek iOS App Security Flaws: A Comprehensive Analysis

In today’s digital landscape, DeepSeek iOS app security flaws have become a major concern for users and organizations alike. With data privacy at the forefront of cybersecurity discussions, recent findings have exposed severe vulnerabilities in the DeepSeek iOS app, making it a potential risk for data breaches and cyberattacks.

The app, which has gained massive popularity, has been found transmitting sensitive user data without encryption, storing critical information insecurely, and even disabling essential iOS security features. These issues raise national security concerns, especially since user data is being sent to ByteDance-owned servers, making it susceptible to foreign surveillance.

This article provides a detailed breakdown of the DeepSeek iOS app security flaws, the risks associated with them, and essential steps users should take to safeguard their data.

Key Security Flaws Identified

1. Unencrypted Data Transmission

One of the most alarming findings from the NowSecure audit is that DeepSeek iOS app security flaws include transmitting sensitive data over the internet without encryption. This means an attacker can easily intercept user information, including mobile app registration details and device data.

Implications:

• Exposure to passive and active cyberattacks (e.g., Man-in-the-Middle attacks).
• Increased risk of data manipulation.
• Greater vulnerability to surveillance and espionage.

2. Weak and Hardcoded Encryption Keys

The DeepSeek iOS app security flaws extend to poor encryption implementation. The app relies on Triple DES (3DES), an outdated encryption algorithm that has been considered insecure for years.

Critical Issues:

• Reusing initialization vectors (IVs), making encryption predictable.
• Hardcoded encryption keys that attackers can easily extract.
• Non-compliance with best security practices, putting user data at risk.

3. Insecure Data Storage

Another critical flaw in the DeepSeek app is its failure to securely store sensitive information such as usernames, passwords, and encryption keys. Cached data is stored in an unprotected manner, allowing attackers with access to an unlocked device to retrieve sensitive information.

Implications:

• User credentials can be stolen.
• Increased risk of account takeovers and identity theft.

4. Extensive Data Collection and Fingerprinting

DeepSeek collects a large amount of user and device data, which can be used for:

• User tracking.
• De-anonymization of individuals.
• Cross-referencing with other datasets for surveillance purposes.

Some of the data collected includes:

• Device language and user agent.
• Organization ID linked to the app install.
• System boot times and app usage details.
• Device ID tracking via fingerprinting techniques.

Implications:

• Users have little control over how their data is used.
• Privacy risks extend beyond the app to other platforms where data is aggregated.

5. Data Sent to China and Governed by PRC Laws

One of the most serious DeepSeek iOS app security flaws is its data transmission to ByteDance-owned servers in China. This means that all collected data is subject to Chinese regulations, which allow government authorities to access it without user consent.

Implications:

• Data stored in China can be accessed by government authorities.
• Enterprises and government agencies using the app may be exposing confidential information to foreign surveillance.
• Regulatory and compliance issues arise for organizations bound by data protection laws such as GDPR.

6. Disabling of App Transport Security (ATS)

DeepSeek globally disables App Transport Security (ATS), an iOS platform protection that prevents data from being sent over unencrypted channels. By disabling ATS, the app can (and does) send unencrypted data over the internet.

Implications:

• Removes a critical security measure designed to protect user data.
• Exposes all transmitted data to potential interception.

7. Use of Fingerprinting APIs

Certain APIs used in the app, such as User Defaults, File Timestamp, or System Boot, can be misused for fingerprinting purposes. Apple mandates developers to disclose such privacy-sensitive APIs, but DeepSeek exhibits behavior indicating a high risk of tracking and surveillance.

Implications:

• Users can be tracked across different platforms and apps.
• Personal data may be used for targeted advertising or government surveillance.

8. Network Traffic Sent to Known Chinese Companies

Even though some DeepSeek servers are located in the United States, further investigation reveals that many IP addresses ultimately route to known Chinese-owned companies, including ByteDance.

Implications:

• Data may be accessed, processed, or stored in China, even if initially transmitted elsewhere.
• Harder to track the final destination of user data.

9. Integration with Third-Party Tracking SDKs

The DeepSeek iOS app security flaws extend to its integration with multiple third-party SDKs, including Intercom, which shares additional tracking data. This integration allows further fingerprinting and may expose user data to additional external parties.

Implications:

• Increases the number of entities with access to sensitive user data.
• Introduces additional risks of third-party breaches.

Global Response to DeepSeek iOS App Security Flaws

Due to these severe security risks, multiple governments and agencies have banned DeepSeek from official use. Some of the affected organizations include:

• U.S. Congress, NASA, Pentagon, and Texas government agencies.
• Government agencies in Australia, Italy, the Netherlands, Taiwan, and South Korea.
• Enterprises restricting the app due to compliance risks.

Additionally, cybersecurity firms like Check Point have found that malicious actors are leveraging AI engines, including DeepSeek, for:

• Developing info-stealing malware.
• Optimizing mass spam distribution scripts.
• Generating uncensored and unrestricted content.

How to Protect Yourself from DeepSeek iOS App Security Flaws

1. Remove DeepSeek from Devices

Individuals and organizations should immediately uninstall DeepSeek from their devices, especially those handling sensitive information.

2. Explore Secure AI Alternatives

Instead of using DeepSeek, organizations can:

• Self-host AI models for greater data control.
• Use alternative AI platforms with stronger security policies (e.g., Microsoft-hosted AI models).

3. Monitor Mobile App Security

With mobile applications being a significant attack vector, enterprises should:

• Conduct regular security assessments of installed apps.
• Implement mobile app security tools to detect vulnerabilities.

4. Strengthen Cyber Hygiene Practices

To further protect user data:

• Use encrypted communication channels (VPNs, secure browsers).
• Avoid providing excessive app permissions.
• Regularly update and review privacy settings on devices.

Appendix: Frida Script Hooking CCCrypt Call

To analyze DeepSeek’s encryption flaws, security researchers can use the following Frida script to hook the CCCrypt function:

frida -U -l cccript.js -f com.deepseek.chat

Script Contents:

var operation = {
0: "kCCEncrypt",
1: "kCCDecrypt"
};

var algorithms = {
0: "kCCAlgorithmAES128",
1: "kCCAlgorithmDES",
2: "kCCAlgorithm3DES",
3: "kCCAlgorithmCAST",
4: "kCCAlgorithmRC4",
5: "kCCAlgorithmRC2"
};

var options = {
1: "kCCOptionPKCS7Padding",
2: "kCCOptionECBMode",
3: "kCCOptionECBMode with kCCOptionPKCS7Padding"
};

function base64FromArg(arg, length) {
var data = ObjC.classes.NSData.dataWithBytes_length_(arg, length);
return data.base64EncodedStringWithOptions_(0).toString();
}

var cccrypt = Module.findExportByName(null, "CCCrypt");
var outData;
var outputLength;

Interceptor.attach(cccrypt, {
onEnter: function(args) {
console.log("
================ CCCrypt Call ================");

var op = args[0].toInt32();
var algo = args[1].toInt32();
var opt = args[2].toInt32();
var keySize = args[4].toInt32();
var key = base64FromArg(args[3], keySize);
var iv = Memory.readByteArray(args[5], keySize);
var ivContent = "None";
var dataLength = args[7].toInt32();
var dataIn = base64FromArg(args[6], dataLength);
outData = args[8];
outputLength = args[10];

console.log("Operation => ", operation[op]);
console.log("Algorithm => ", algorithms[algo]);
console.log("Options => ", options[opt] || "kCCOptionCBCMode");
console.log("Key size => ", keySize);
console.log("Key => ", key);
if (iv !== null) {
var data = ObjC.classes.NSData.dataWithBytes_length_(args[5], keySize);
ivContent = data.base64EncodedStringWithOptions_(0).toString();
}
console.log("IV => ", ivContent);
console.log("Data input => ", dataIn);
},
onLeave: function(ret) {
var len = Memory.readPointer(outputLength).toInt32();
var data = base64FromArg(outData, len);
console.log("Data output => ", data);
}
});

Conclusion

The DeepSeek iOS app security flaws present multiple security risks, from unencrypted data transmission to extensive user tracking. Given these vulnerabilities, it is critical for individuals and organizations to stop using the app and seek more secure alternatives. By implementing proactive cybersecurity measures, users can better protect their data from potential breaches and surveillance threats.

Stay informed about cybersecurity threats. Share your thoughts in the comments and explore safer AI alternatives today!