DeepSeek iPhone app sends unencrypted data, disabled security features
Security researchers discovered that the DeepSeek iPhone app disables Apple's standard encryption protections and uses outdated encryption, allowing sensitive user data to be transmitted unencrypted. Aggregation of exposed data points could potentially identify individual users.
What happened
Mobile security company NowSecure discovered multiple security vulnerabilities in DeepSeek's iPhone application. The app globally disables Apple's App Transport Security (ATS), an iOS platform-level protection that prevents sensitive data from being sent over unencrypted channels, allowing the app to send unencrypted data over the internet.
NowSecure also found that DeepSeek uses an outdated encryption method known to have security flaws. The company noted that while individual data points may seem harmless, their aggregation over time can easily reveal a user's identity.
Reported impact
Users of the DeepSeek iPhone app have had sensitive data transmitted over unencrypted channels, creating exposure risk. The aggregation of exposed data points could potentially de-anonymize users, as demonstrated by previous data breaches involving large-scale data collection.
Index analysis
The security flaws represent a departure from standard iOS security practices, as ATS is a built-in platform protection disabled in this application. The combination of unencrypted transmission and outdated encryption creates multiple layers of vulnerability.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.