360 Security Lobster Product Has Private Key Leak Issue; Third Parties Can Forge Encrypted Connections

360's recently released security product "Security Lobster" was detected with a serious security flaw. The product directly packed the wildcard domain certificate for *.myclaw.360.cn and its corresponding private key into the local installation directory to enable local HTTPS connections.

This wildcard certificate covers all subdomains under myclaw.360.cn. After the private key is leaked, third parties can forge HTTPS encrypted connections under this domain, and the certificate has not been revoked yet.

The 360 SRC team responded that this is a known internal issue and is being handled.