DeepSeek iOS App Exposes Device and Registration Data via Unencrypted Transmission
The DeepSeek iOS mobile application, which became the top iOS app shortly after its January 2025 release, transmits sensitive registration and device data over unencrypted channels to servers linked to ByteDance’s infrastructure in China. This vulnerability was identified by NowSecure through a comprehensive security and privacy assessment conducted on real iOS devices. The findings reveal that the app disables Apple’s built-in transport security protections, exposing data to interception and manipulation during transmission.
During initial app launch, the DeepSeek iOS app communicates with its backend infrastructure at fp-it.fengkongcloud.com to register the device and establish a device profile. This process occurs even under active network attacks, such as Man-in-the-Middle (MITM) scenarios, where an attacker could passively monitor traffic or actively alter data. For example, an unencrypted network request to http://fp-it.fengkongcloud.com/v3/cloudconf exposes device details, including configured languages (e.g., English), user agent information, organization identifiers (e.g., P9usCUBauxft8eAmUXaZ), and operating system specifics. While individual data points may seem benign, their aggregation over time enables precise user identification, as demonstrated by breaches involving data brokers like Gravy Analytics.
A subsequent request to the deviceprofile endpoint (http://fp-it.fengkongcloud.com/deviceprofile/v4) transmits additional data, some of which is compressed or encrypted. However, the initial unencrypted transmission remains a critical flaw, as it undermines both confidentiality and data integrity. The exposure of this information aligns with broader concerns about mass data collection and de-anonymization risks, particularly in contexts where user privacy is paramount, such as government or enterprise environments.
Weak and Hardcoded Encryption Compromises Data Security
Beyond unencrypted transmission, the DeepSeek iOS app employs outdated and insecure encryption practices. The app uses Triple DES (3DES), an algorithm widely recognized as cryptographically broken due to its susceptibility to brute-force attacks. Additionally, the implementation reuses initialization vectors (IVs) and hardcodes encryption keys, violating fundamental security principles. These flaws were identified in a custom service called BDAutoTrackLocalConfigService, specifically within the saveUser function, where NowSecure’s research team traced encryption calls using tools like radare2 and Frida.
The hardcoded encryption key and NIL initialization vector further exacerbate the risk, as they eliminate the dynamic nature of secure encryption. The use of 3DES, combined with these implementation weaknesses, creates a significant vulnerability that could be exploited to compromise user credentials, session tokens, or other confidential information.
Insecure Data Storage and Credential Exposure
The DeepSeek iOS app also stores sensitive user data, including usernames, passwords, and encryption keys, in an insecure manner. This risk is amplified by the app’s reliance on the NSURLRequest API, which defaults to caching HTTP responses in a Cache.db file on the device. Under certain conditions—such as physical access to an unlocked device—this cached data can be extracted by an attacker. NowSecure recovered redacted samples of this cached data, confirming the presence of sensitive information that could be exploited if the device is compromised.
The insecure storage of credentials and encryption keys introduces additional risks, particularly in environments where devices may be shared or lost. Even if data transmission is later secured, the persistent storage of sensitive information on the device itself remains a critical vulnerability.
Data Transmission to Chinese Servers and Compliance Risks
User data transmitted by the DeepSeek iOS app is routed to servers controlled by ByteDance, a company subject to China’s legal framework. This raises significant compliance and sovereignty concerns, particularly for organizations operating in jurisdictions with strict data protection regulations. Under Chinese law, data stored or processed on servers within the country may be subject to government access or surveillance, regardless of the user’s location. This creates risks for enterprises and government agencies handling sensitive or proprietary information.
The aggregation of device and user data by ByteDance’s infrastructure also introduces surveillance risks. Historical breaches, such as the exposure of Gravy Analytics’ data, demonstrate how collected information can be used to de-anonymize individuals at scale. For government or military users, the transmission of device profiles and organizational identifiers to servers governed by foreign laws could compromise operational security or intellectual property.
Government and Enterprise Bans Follow Disclosure
Countries, state and federal agencies, and even the U.S. military have banned the DeepSeek iOS app from government-issued devices to mitigate cyber risks and protect national security. The Korean Personal Information Protection Commission (PIPC) also suspended the app’s operations following the findings.
The swift bans underscore the severity of the identified risks, particularly in high-security environments where data leakage or surveillance could have strategic consequences. Enterprises are advised to remove the app from managed and Bring-Your-Own-Device (BYOD) deployments and explore alternative AI platforms with stronger security and privacy controls. Continuous monitoring of mobile applications is recommended to detect and address emerging risks, as similar vulnerabilities may exist in other widely used apps.
Technical Mitigations and Recommendations
- Immediate Removal: Organizations should uninstall the DeepSeek iOS app from all devices to eliminate exposure to unencrypted transmission and insecure storage risks.
- Alternative AI Platforms: Users and enterprises can transition to self-hosted or third-party hosted versions of AI models (e.g., Microsoft’s offerings) or adopt other AI tools that prioritize encryption and data sovereignty.
- Tools like NowSecure’s analysis framework can help detect flawed implementations of encryption, data transmission, and storage practices.