ccy
79 posts








China's biggest cybersecurity company apparently just shipped an AI assistant with its own SSL private key sitting inside the installer. Qihoo 360, think Norton or McAfee, but dominant across the entire Chinese market It appears that their new AI product, 360安全龙虾 (Security Claw) bundles a wrapper on @OpenClaw. Inside the installer package - accessible to anyone who downloaded it - was a private SSL certificate key for the domain *.myclaw.360.cn. An SSL private key is essentially the master password to a website's encrypted connection. With it, an attacker can impersonate 360's servers, silently intercept user traffic, forge a login page that looks completely legitimate, or possibly take over the AI agent altogether. The cert is valid until April 2027 and covers every subdomain on the platform. It's now public. The founder launched the product with a promise it would "never leak passwords". It did that during release? 461 million users, a $10B valuation, and nobody checked the zip file before shipping. The cert expires April 2027.




四、后续处理方案 为避免用户因参与本次活动而额外承担手续费支出,我们将对部分场景下的礼包进行统一处理,并对受影响用户安排礼包召回。召回适用范围包括以下三类用户: 1/已参与活动并完成相关交易,但未领取礼包的用户; 2/已领取礼盒但尚未打开的用户; 3/在活动奖池发放完毕后仍完成开盒,但未正常获得对应奖励的用户。


































