Disabling App Transport Security (ATS) in the DeepSeek app significantly increases the risks associated with its use, particularly concerning data privacy and security. Here's a detailed explanation of these risks:
1. Unencrypted Data Transmission: By disabling ATS, DeepSeek allows the transmission of sensitive user and device data over unencrypted channels. This means that data such as registration information and device details are sent without any encryption, making it easily interceptable by cybercriminals. This vulnerability exposes users to both passive and active attacks, where attackers can not only intercept but also manipulate the data being transmitted[3][6][9].
2. Man-in-the-Middle (MitM) Attacks: The lack of encryption due to ATS disablement creates an easy entry point for man-in-the-middle attacks. In such attacks, an attacker can intercept and alter the communication between the app and its servers, potentially leading to data theft or the injection of malicious content[3].
3. Increased Risk of Cyberattacks: DeepSeek has already faced significant cyberattacks, and disabling ATS exacerbates this vulnerability. By allowing unencrypted HTTP traffic, the app becomes more susceptible to future attacks, as attackers can exploit the lack of security measures to gain unauthorized access to user data[2][3].
4. Data Privacy Concerns: DeepSeek collects extensive user and device data, which is then transmitted to servers managed by ByteDance, a Chinese company. The absence of ATS means this data is sent without encryption, raising serious concerns about data privacy and potential misuse by third parties, including state-sponsored entities[2][5][9].
5. Weak Encryption Practices: Beyond the ATS issue, DeepSeek's encryption methods are also flawed. The app uses an insecure symmetric encryption algorithm (3DES) with hardcoded keys and reused initialization vectors, further weakening the protection of user data. This poor encryption practice, combined with the lack of ATS, makes it easier for attackers to decrypt and exploit sensitive information[6][9].
In summary, disabling ATS in DeepSeek increases the risk of data interception, manipulation, and exploitation by cybercriminals. It also highlights broader concerns about data privacy and security, particularly given the app's extensive data collection practices and transmission of data to servers linked to Chinese entities.
Citations:
[1] https://cocoacasts.com/the-definitive-guide-to-app-transport-security
[2] https://sbscyber.com/blog/deepseek-ai-dangers
[3] https://approov.io/blog/deepseek-apps-security-failures-how-approov-could-have-prevented-the-damage
[4] https://www.infosecinstitute.com/resources/application-security/ios-application-security-part-46-app-transport-security/
[5] https://securityscorecard.com/blog/a-deep-peek-at-deepseek/
[6] https://www.connectyourplatform.com/blogs/deepseek-ios
[7] https://sdks.support.brightcove.com/ios/framework/working-app-transport-security-ats.html
[8] https://www.csis.org/analysis/delving-dangers-deepseek
[9] https://thehackernews.com/2025/02/deepseek-app-transmits-sensitive-user.html