Exposed DeepSeek database leaking sensitive information, including chat history

This is probably an <i>incredibly</i> stupid, off-topic question, but why are their database schemas and logs in English?<p>Like, when a DeepSeek dev uses these systems as intended, would they also be seeing the columns, keys, etc. in English? Is there usually a translation step involved? Or do devs around the world just have to bite the bullet and learn enough English to be able to use the majority of tools?<p>I&#x27;m realizing now that I&#x27;m very ignorant when it comes to non English-based software engineering.

Thank you everyone, this was responsibly disclosed to DeepSeek and published after the issue was remediated, we got acknowledgment from their team today on our contribution.

Interesting to note:<p>- Dev infra, observability database (open telemetry spans)<p>- Logs of course contain chat data, because that&#x27;s what happens with logging inevitably<p>The startling rocket building prompt screenshot that was shared is meant to be shocking of course, but most probably was training data to prevent deepseek from completing such prompts, evidenced by the `&quot;finish_reason&quot;:&quot;stop&quot;` included in the span attributes.<p>Still pretty bad obviously and could have easily led to further compromise but I&#x27;m guessing Wiz wanted to ride the current media wave with this post instead of seeing how far they could take it. Glad to see it was disclosed and patched quickly.

open exposed clickhouse is this decade&#x27;s open exposed elasticsearch so common in the past

Does DeepSeek have a bug bounty program I&#x27;m not aware of with a clearly defined scope? It appears that Wiz took it upon themselves to probe and access DeepSeek&#x27;s systems without permission and then write about it.<p>If you do this and the company you&#x27;re conducting your &quot;research&quot; on hasn&#x27;t given you permission in some form, you can get yourself in a lot of hot water under the CFAA in the USA and other laws around the world.<p>Please don&#x27;t follow this example. Sign up for a bug bounty program or work directly with a company to get permission before you probe and access their systems, and don&#x27;t exceed the access granted.

Ironic - I bet if you ask deepseek r1 how to set up clickhouse it would tell you the right way to do it.

Can you imagine executing arbitrary SQL queries via your web browser? :D<p>Complete database control and potential privilege escalation within the DeepSeek environment without ANY authentication...

And that&#x27;s why you run models locally. Or if you want a remote chat model, use something stateless like AWS Bedrock custom model import to avoid having stored chats on the server.

The second Big Tech was threatened by significant competition (DeepSeek), this competition is &quot;stealing&quot;(lol), and is under heavy hacking attacks (main online inference portal).<p>There you have, the real face of Big Tech. Extinguishing the competition by locking a service behind a portal provided for free, then starting to milk the users, is not enough for them... they will also fight dirty, really dirty.

Good finding. I don&#x27;t see its timeline usually discussed in other Ethical hacking and responsible disclosures.

Ugh. I know I’ve got at least some keys in those logs. Thankfully nothing too intense

It seems fair since all the other AI&#x27;s scraped copyrighted information, images, video online and from pirated books, etc. without ever asking anyone first.

The amount of vitriol in these comments is the really surprising data. I&#x27;ve seen the same on Twitter. I can only put it down to the financial pain DeepSeek inflicted on many US retail investors by wiping almost $700 billion off NVidia&#x27;s stock price. I think a lot of folks didn&#x27;t see it coming and it hurt them right where it matters most: In the wallet. The anger out there is very real.

Where&#x27;s the download link?

A data point on self-hosting being preferable, or using an alternate gpu cloud host who can run the model privately&#x2F;semi-privately for you.

Poorly secured or not it still managed to hit your favourite stock. The execs at NVIDIA still haven’t recovered from the bloodbath.

This kinda does support the &#x27;DeepSeek is the side project of a bunch of quants&#x27; angle.<p>Seems like the kind of mistake you would make if you are not used to deploying external client facing applications.

&gt; More critically, the exposure allowed for full database control and potential privilege escalation within the DeepSeek environment, without any authentication or defense mechanism to the outside world.<p>Not only that, this was a &quot;production-grade&quot; database with millions of users using it and the app was #1 on the app store and ALL text sent there in the prompts was logged in plain-text?<p>Unbelievable.

Another example of DeekSeek copying straight from OpenAI&#x27;s playbook [1] [2]<p>[1] <a href="https:&#x2F;&#x2F;www.reuters.com&#x2F;technology&#x2F;cybersecurity&#x2F;openais-internal-ai-details-stolen-2023-breach-nyt-reports-2024-07-05&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reuters.com&#x2F;technology&#x2F;cybersecurity&#x2F;openais-int...</a><p>[2] <a href="https:&#x2F;&#x2F;openai.com&#x2F;index&#x2F;march-20-chatgpt-outage&#x2F;" rel="nofollow">https:&#x2F;&#x2F;openai.com&#x2F;index&#x2F;march-20-chatgpt-outage&#x2F;</a>

I wonder if this is the &quot;cyberattack&quot; DeepSeek was talking about?

I don&#x27;t get the discussions around side project and they&#x27;re ML engineers, not security experts. Why are you excusing a company for a serious security leak.<p>If you&#x27;re releasing a major project into the wild, expect serious attention and have the money, you get third parties involved to test for these things before you launch.<p>Now can we get back to discussing the real conspiracy theories. This is clearly a disinformation piece by BigAI to add FUD around the Chinese challenger :-)

How do we know for sure that DeepSeek is not actually trained on Nvidia chips? Did someone outside of China replicated the training from scratch (Spending $6M)?

that&#x27;s why i never use my strong passwords in many chinese websites(in fact, i tend not to use passwords in any website)<p>i suggest you guys don&#x27;t do that also<p>this industry in china is so young, many devs and orgs don&#x27;t understand what will happened if they shutdown the firewall or expose their database on the internet without a password<p>they just, can&#x27;t think of it, need someone to remind them

Never forget honeypots.

So much effort in trying to tarnish DeepSeek the last 24hrs

It’s a feature, not a bug !

This is totally expected when you use AI to build your infrastructure.

[edit: Nevermind, see below]<p>The direct disclosure of urls and ports is insane. Wonder if they would be as irresponsible if it was MSFT, OpenAI, Anthropic, etc.<p>PS: Not defending DeepSeek for bad practices, but still. Nothing irresponsible here.<p>PS2: It is marked as resolved, I went directly to the vulns due to the title of the post.

This doesn&#x27;t look like a responsible disclosure, at all.<p>ed: I was wrong!

Man! I used deepseek.com luckily I didn&#x27;t use the same password as I use. :) Time to use ollama!