Security Product Leaks Instead: 360 Security Lobster Bundles HTTPS Wildcard Certificate Private Key into Local Directory

According to 1M AI News, a recent security product released by 360 called "Security Lobster" was found to have bundled the wildcard domain certificate and corresponding private key for *.myclaw.360.cn directly into the local installation directory. The Security Lobster's interface is based on a custom version of the 360 browser, accessed through the local address https://myclaw.360.cn:19798/. In order to achieve this local HTTPS connection, engineers included both the wildcard certificate and private key in the client.

This wildcard certificate covers all subdomains under myclaw.360.cn. In the event of a private key leak, a third party could forge an HTTPS encrypted connection under this domain. The certificate has not been revoked at this time. The 360 SRC team responded, stating that this is an internally known issue and is being addressed.