company logo

Product

Our Product

We are Reshaping the way Developers find and fix vulnerabilities before they get exploited.

Solutions

By Industry

BFSI

Healthcare

Education

IT & Telecom

Government

By Role

CISO/CTO

DevOps Engineer

Resources

Resource Library

Get actionable insight straight from our threat Intel lab to keep you informed about the ever-changing Threat landscape.

Subscribe to Our Weekly Threat Digest

Company

Contact Us

Have queries, feedback or prospects? Get in touch and we shall be with you shortly.

loading..
loading..
loading..
Loading...

Oracle

Weblogic

Vulnerability

loading..
loading..
loading..

Oracle released 342 fixes against a critical Remotely exploitable WebLogic Server Flaw

Oracle released a security patch update for a remotely exploitable WebLogic Server flaw. Each vulnerability is identified by a unique CVE# identifier. The compa...

23-Jul-2021
3 min read

No content available.

Related Articles

loading..

Data Leak

DeepSeek

DeepSeek’s data breach exposes 1 million logs, triggering a global AI security c...

In what can only be described as one of the most alarming data security breaches of the decade, the Chinese AI startup [DeepSeek](https://www.secureblink.com/cyber-security-news/deep-seek-s-security-breach-sparks-fear-can-open-ai-hold-its-ground) has exposed over a million lines of sensitive data through an unsecured, publicly accessible ClickHouse database. This breach is not just an inconvenience for DeepSeek—it signals a massive vulnerability in the world of AI and data security, raising alarming questions for the industry, regulators, and the privacy-conscious public. ### **DeepSeek Exposes the Hidden Dangers of AI Infrastructure** DeepSeek has recently made headlines with its revolutionary AI models, particularly the *DeepSeek-R1 reasoning model*, which has stunned the AI community for its groundbreaking performance, efficiency, and affordability. While its technical achievements have sparked interest, security experts are now reeling from the exposure of critical vulnerabilities within the company’s infrastructure. In a rapid investigation conducted by [Wiz Research](https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak), a team of cybersecurity professionals discovered a massive exposure within [DeepSeek’s](https://www.secureblink.com/cyber-security-news/deep-seek-eu-scrutiny-intensifies-over-data-privacy-and-ai-security) backend systems. The breach stemmed from a publicly accessible ClickHouse database hosted on unsecured servers at oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000. This database, which was not protected by any form of authentication, was wide open to anyone with a web browser and the most basic knowledge of database queries. ### **Sensitive Data in the Wild: Chat Logs, API Keys, and More** What was exposed was nothing short of catastrophic: over a million log entries, containing highly sensitive information such as private chat history, API keys, backend data, and operational metadata. The ClickHouse database, a popular columnar database system designed for real-time analytics, hosted not just casual logs but the very essence of DeepSeek’s infrastructure. Among the most alarming files were: - **Chat History**: Plaintext logs revealing customer interactions, complete chat messages, and detailed user queries. - **API Keys**: Exposed secrets from DeepSeek’s internal APIs, providing unauthorized access to their systems and infrastructure. - **Backend Details**: Metadata that allowed researchers to pinpoint internal services, database schema, and real-time operational processes. - **Sensitive Logs**: Entries dating from January 6, 2025, detailing every request made to their servers, exposing operational vulnerabilities. This data is far more than just inconvenient—it contains everything a malicious actor needs to access, control, or even disable DeepSeek’s services. ### **Risks of Exposed Data** DeepSeek’s breach isn't just another security hole—it's a glaring oversight with enormous implications. The unprotected database allowed for full control over DeepSeek’s infrastructure, with no authentication or defense mechanisms in place. This means any attacker who stumbled upon the database could easily escalate privileges, tamper with the data, or exfiltrate sensitive information. While Wiz Research refrained from running intrusive queries, the discovery alone underscores a dangerous vulnerability. But the worst is yet to come. While the exposed logs showed extensive chat history, which could compromise user privacy, they also exposed system configurations and API credentials that could allow hackers to gain unauthorized access to proprietary systems and perform malicious actions, such as data exfiltration or further system manipulation. ### **Critical Security Flaw for AI Companies** This breach should serve as a wake-up call to the AI community. While much of the focus on AI security has been placed on futuristic threats such as data poisoning or adversarial attacks, this incident highlights a more immediate and tangible risk—an AI startup's lack of basic security hygiene. DeepSeek, which had raised its profile by promoting cost-effective AI services, now faces scrutiny not just for its AI performance but for its glaring failure to secure its backend infrastructure. As companies rush to deploy AI models at breakneck speed, they’re often overlooking the basic principles of secure application development, putting millions of users at risk. For those wondering about the broader implications, this incident is more than a wake-up call for DeepSeek—it represents a critical security lapse in the growing AI sector. If an AI startup with the capabilities of DeepSeek can make such fundamental mistakes, what does that say for others working in the same space? ### **Data Privacy Crisis and Lack of Regulation** The scale of this breach isn't just a DeepSeek problem. It reflects a broader systemic issue in the AI and technology industries—one where speed to market and cost-cutting often outweighs robust security frameworks. DeepSeek’s publicly exposed database further underscores the lack of regulatory oversight in this rapidly expanding sector. While data privacy laws like the **GDPR** (General Data Protection Regulation) in Europe and the **CCPA** (California Consumer Privacy Act) in the United States are designed to protect personal data, the enforcement of such laws has proven inadequate in holding tech companies accountable for fundamental security flaws. The breach has already caught the attention of several watchdog organizations. Both the **Irish Data Protection Commission (DPC)** and **Italy’s Data Protection Authority** (DPA) have issued requests for more information regarding DeepSeek's data processing practices, citing concerns over the protection of European citizen data. While DeepSeek's exposure was eventually secured, the question remains: What about other AI companies? As AI startups and tech giants continue to innovate at breakneck speeds, they must not forget that data security is just as important as the technology they create. The industry needs a shift in focus—security can't be an afterthought, it must be a priority.

loading..   01-Feb-2025
loading..   5 min read
loading..

Data Privacy

GDPR

DeepSeek faces intensified EU scrutiny over data privacy and AI security. Regula...

The jury is still out on whether **[DeepSeek](https://www.secureblink.com/cyber-security-news/deep-seek-s-security-breach-sparks-fear-can-open-ai-hold-its-ground)**, the Chinese AI upstart that has taken the tech world by storm with its groundbreaking **R1 model**, is a game-changing force in AI or part of a larger strategy by its hedge fund parent company to disrupt markets. However, one thing is becoming evident: _**DeepSeek’s rapid rise is attracting more than just attention—it’s now on the radar of regulators, and they are not happy.**_ Over the past few days, _**data protection watchdogs in both Ireland and Italy**_ have escalated concerns, sending urgent requests to DeepSeek about its data processing practices. The **Irish Data Protection Commission** (DPC) confirmed that it had formally reached out to DeepSeek, asking for detailed information on how it handles the data of Irish citizens. Meanwhile, the **Italian Data Protection Authority (DPA)** has gone a step further, pulling DeepSeek’s mobile app from major app stores in Italy after **Euroconsumers**—a coalition of consumer protection groups—filed a formal complaint regarding its handling of personal data under **[GDPR](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)** (General Data Protection Regulation). ### **DeepSeek At Risk?** The core of the issue lies in **DeepSeek’s data practices**. As a company operating out of China, where data laws differ significantly from those in Europe and the U.S., its **privacy policies** are raising serious red flags. For starters, DeepSeek’s app collects a vast amount of personal data, which it stores on **servers in China**. But here’s where it gets more complicated: According to its **[privacy policy](https://chat.deepseek.com/downloads/DeepSeek%20Privacy%20Policy.html)**, DeepSeek claims to transfer data **in accordance with the laws of the country where the service is used**—but this leaves a lot to interpretation. Both the Irish and Italian regulators have demanded more transparency on **how and why** personal data is being processed, especially as it relates to **AI training** and the legality of its data collection methods. **But the stakes are even higher**—DeepSeek has come under fire for its apparent **lack of transparency** regarding **web scraping** practices and how it handles data from users who aren’t registered. The Italian DPA wants to know more about **how DeepSeek scrapes data from the web** and whether users are informed in advance about this practice. More troubling, the company has been unable to provide concrete assurances on how **minors’ data** is handled, despite claiming that its service isn’t intended for users under the age of 18. ### **Data Privacy Storm Is Brewing** The **Italian DPA** has given **DeepSeek 20 days to respond**. Their letter, bluntly stating that “**millions of Italians' data is at risk**,” signifies the gravity of the situation. It’s not just Italy—**DeepSeek is under the spotlight across Europe**, with more regulators potentially following suit. What’s even more concerning is the **apparent lack of safeguards for European users**. Given DeepSeek’s operations in China, the **Chinese government’s access to data** is a well-known risk, and the European regulators are demanding clarity. As of now, DeepSeek has not responded publicly to these queries. ### **Will the EU’s Regulatory Framework Be Enough?** In an emergency press conference today, **European Commission spokesperson Thomas Regnier** weighed in on the growing concerns over DeepSeek’s security and privacy practices. For now, the **EU** has not launched an investigation but has stressed that the **AI Act** will apply to all AI services operating in Europe—**regardless of their country of origin**. But the question remains: How will the **EU handle the intersection of data privacy, security, and the power imbalance in AI?** While the Commission remains cautious, the growing scrutiny from Italy and Ireland could be a harbinger of **wider regulatory actions across the continent**. ### **Potential Copyright Violations** Amid the privacy concerns, **another storm is brewing** around DeepSeek’s **AI training practices**. Some reports from **Microsoft** and **OpenAI** suggest that DeepSeek may have used “distillations” from their proprietary models to train its own AI system, raising **serious questions** about **intellectual property rights and potential copyright violations**. If these claims prove true, the ramifications could be immense. The potential **legal battle over intellectual property** could further complicate DeepSeek’s path to global legitimacy, especially when its **AI models** are already at the center of fierce debates over security and ethical usage. ### **What Does This Mean for DeepSeek’s Future?** As **DeepSeek’s app** continues to be removed from major platforms in Europe, the company faces a **critical crossroads**: respond to the mounting regulatory scrutiny, clarify its data practices, and potentially **rethink its global strategy**, or face ongoing pressure from regulators who are far from satisfied with its answers. For now, DeepSeek is trying to stay under the radar, keeping a low profile while it navigates this web of regulatory and legal challenges. However, with **Europe’s data protection authorities**, **consumer rights groups**, and **global tech companies** watching closely, **DeepSeek’s future** as a player in the global AI race is more uncertain than ever.

loading..   30-Jan-2025
loading..   5 min read
loading..

AI

DeepSeek

A small Chinese startup, DeepSeek, has launched the R1 AI model, quietly shaking...

In a world dominated by AI giants like OpenAI and Google, a quiet but alarming disruption is brewing in the heart of China. DeepSeek, an unassuming startup from Hangzhou, has launched a new AI model, *R1*, that promises to challenge not just the technical superiority of Silicon Valley but the very structure of the global AI industry. While its emergence has been overshadowed by the usual headlines of AI wars, the subtle yet profound implications of *R1* are shaking up investors, researchers, and policymakers alike. At the surface, *R1* is simply another reasoning AI model, designed to tackle tasks in mathematics, coding, and logic. But scratch deeper, and it becomes clear: this isn’t just about another entrant into the AI race—it’s about how a small team, operating under tight constraints, may have just rewritten the playbook for the AI future. --- ### **How DeepSeek Did More With Less** Training an AI model like OpenAI’s GPT-4 requires staggering resources. And being conservative estimates, the cost to develop and train such models can exceed $100 million, utilizing tens of thousands of top-tier GPUs. [DeepSeek](https://status.deepseek.com/incidents/666k4t024szr), however, has achieved similar benchmarks for *R1* using just $5.58 million and a fraction of the computational infrastructure. Instead of relying on the high-end Nvidia H100 chips that power OpenAI’s systems, DeepSeek used lower-performance H800 GPUs, specially throttled for the Chinese market under U.S. export restrictions. Remarkably, *R1* doesn’t just compete—it excels. On reasoning tasks, it has been shown to outperform OpenAI’s o1 model, with initial tests suggesting up to a **20% improvement in efficiency and task accuracy** in certain benchmarks. This achievement isn't merely technical; it's political. The world is watching as [U.S. sanctions](https://www.technologyreview.com/2025/01/24/1110526/china-deepseek-top-ai-despite-sanctions/), intended to slow China's AI development, appear to have forced a pivot toward innovation rather than stagnation. --- ### **Geopolitical Undercurrents-A Model Built on Sanctioned Chips** DeepSeek’s founder, Liang Wenfeng, understood the gravity of the U.S. export controls well before they took effect. Years before the restrictions on Nvidia A100 chips were imposed, Liang stockpiled thousands of these units, ensuring his company could experiment and innovate while others scrambled for hardware. Today, it’s estimated that DeepSeek has access to **10,000–50,000 A100 units**, enough to sustain years of training cycles. But what sets DeepSeek apart is not just its foresight. It’s the way the company combined its hardware arsenal with engineering simplicity. Instead of brute-forcing computations like many Western models, *R1* uses a novel technique called _**“sparsity optimization.”**_ This approach allows it to train only the most relevant parameters of the model, slashing computational costs and enabling faster results. While this technique is gaining traction globally, DeepSeek has perfected it to the point where its models are not only cheaper to train but can also run on everyday devices. Imagine running a high-performing AI system locally on your laptop—DeepSeek has made that a reality with smaller versions of *R1*. --- ### **An Open-Source Trojan Horse?** In what some see as a strategic masterstroke, DeepSeek has taken the unusual step of open-sourcing *R1* and its smaller variants. These smaller models, which can even outperform OpenAI’s *o1-mini* on specific benchmarks, are freely available for anyone to download and use. This move has triggered a wave of excitement—and unease—across the AI community. For researchers in underfunded regions, particularly in the Global South, it’s a lifeline. Access to powerful AI models has been largely gated by expensive cloud services or high-end hardware. Now, DeepSeek is changing the rules, offering tools that can run locally on laptops without requiring an internet connection. However, there’s a darker side to this openness. Critics warn that open-sourcing such advanced models could accelerate misuse. With *R1* being available to anyone, including bad actors, questions around security and ethical safeguards loom large. Could this openness lead to unintended consequences, such as the proliferation of AI tools for malicious purposes? --- ### **Silicon Valley’s Nightmare** For years, AI development has been dominated by Silicon Valley, with companies like [OpenAI](https://www.secureblink.com/cyber-security-news/anonymous-sudan-admits-layer-7-d-do-s-attack-on-open-ai-s-chat-gpt), [Google](https://www.secureblink.com/cyber-security-news/google-reclassifies-zero-day-libwebp-vulnerability-as-critical-cve-2023-5129), and Microsoft commanding an outsized share of the industry. Their business models depend on cloud-based services, subscription fees, and tight control over access to their technology. DeepSeek’s *R1*, however, represents a fundamental challenge to this monopoly. By making powerful AI models free and [accessible](https://platform.deepseek.com/sign_up), DeepSeek is undermining the financial and technological gatekeeping that has defined the industry. Investors are already feeling the ripple effects. Since the release of *R1*, Nvidia has reportedly lost _**$600 billion in market value**_ amid concerns over how cost-efficient models like *R1* could disrupt demand for high-end GPUs. Tech insiders are calling this the "beginning of the end" for AI monopolies. If models like *R1* can deliver top-tier performance without requiring massive cloud infrastructure, the entire economic model of AI could shift—away from centralized services and toward local, distributed systems. --- ### **Innovation or Instability?** DeepSeek’s meteoric rise poses a paradox. On one hand, it democratizes AI, offering tools that empower researchers and developers across the globe. On the other, it raises difficult questions about security, regulation, and the unintended consequences of open-sourcing powerful technology. For now, DeepSeek’s *R1* [model](https://huggingface.co/deepseek-ai) remains a symbol of both promise and uncertainty. Will it usher in a new era of collaboration and accessibility? Or will it destabilize an already fragile tech ecosystem, paving the way for misuse and market chaos? As the world watches, one thing is clear: DeepSeek has changed the game. The question is whether the rest of the world is ready to play by these new rules.

loading..   28-Jan-2025
loading..   6 min read