It seems fair since all the other AI's scraped copyrighted information, images, video online and from pirated books, etc. without ever asking anyone first.
Exposed DeepSeek database leaking sensitive information, including chat history
51–60 of 499 posts
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#52This doesn't look like a responsible disclosure, at all. ed: I was wrong!
Who's going to go after them? Heck, they may get an award for this.
If random security researcher does this kind of disclosure, fine.
But if serious company that seems to offer services to seemingly plenty of serious customers acts this way, I'd not want to be their customer, if they seem to have such a cavalier attitude, disclosing stuff without even a sniff of "we notified the company about the breach".
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#53Man! I used deepseek.com
luckily I didn't use the same password as I use. :)
Time to use ollama!
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#54Earlier quoted context omitted.
I'm not sure why you think why this discovery has to be some sort of "effort in trying to tarnish DeepSeek". Deepseek is the #1 downloaded app and and the media can't stop talking about it. That means a lot more people are looking into the app and possibly finding vulnerabilities, no conspiracy needed.
edit: snip, misinfo, I'm illiterate. Sorry!
> instead of following responsible disclosure practices
They literally did, though? They were resolved before publishing.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#55Earlier quoted context omitted.
edit: snip, misinfo, I'm illiterate. Sorry!
What are you talking about? They did follow responsible disclosure.
No idea why this is downvoted.
Responsible disclosure normally means you wait up to 90 days so they can fix it, before you disclose it to the public. In this case, it was fixed immediately, so they disclosed it to the public immediately.
Which is another thing it seems Chinese corporations do better than American ones.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#56And that's why you run models locally. Or if you want a remote chat model, use something stateless like AWS Bedrock custom model import to avoid having stored chats on the server.
Not many non-gamers have hardware capable of running such a model locally - never mind the skills. For most people, bash is not a tool for interacting with the computer, it is how they express their frustration with the computer (sometimes leaving damaged keyboards).
Wow all the gamers with mad LLM skillz.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#57Earlier quoted context omitted.
Who's going to go after them? Heck, they may get an award for this.
If random security researcher does this kind of disclosure, fine. But if serious company that seems to offer services to seemingly plenty of serious customers acts this way, I'd not want to be their customer, if they seem to have such a cavalier attitude, disclosing stuff without even a sniff of "we notified the company about the breach".
It was fixed. Disclosing it after it's fixed is responsible.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#58Interesting to note:
- Dev infra, observability database (open telemetry spans)
- Logs of course contain chat data, because that's what happens with logging inevitably
The startling rocket building prompt screenshot that was shared is meant to be shocking of course, but most probably was training data to prevent deepseek from completing such prompts, evidenced by the `"finish_reason":"stop"` included in the span attributes.
Still pretty bad obviously and could have easily led to further compromise but I'm guessing Wiz wanted to ride the current media wave with this post instead of seeing how far they could take it. Glad to see it was disclosed and patched quickly.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#59And that's why you run models locally. Or if you want a remote chat model, use something stateless like AWS Bedrock custom model import to avoid having stored chats on the server.
You could also use models that run on nvidia’s trusted execution environment.
Re: Exposed DeepSeek database leaking sensitive information, including chat history
#60So much effort in trying to tarnish DeepSeek the last 24hrs
Can't fault hackers for taking a look at a website that goes from "virtually unknown" to "extremely popular and headline news globally" practically over night. If nothing else, the probability of low-hanging fruit in something that is barely battle-tested is high. You can fault them for disclosure practices though :-)
> Wiz Research has identified a publicly accessible ClickHouse database belonging to DeepSeek, which allows full control over database operations, including the ability to access internal data. The exposure includes over a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information.
>The Wiz Research team immediately and responsibly disclosed the issue to DeepSeek, which promptly secured the exposure.
It seems like Wiz told deepseek and deepseek secured this vuln?