DomainTools Reports Exposed Qihoo 360 Security Claw TLS Private Key
Summary
DomainTools reports that a private key matching Qihoo 360 Security Claw’s wildcard TLS certificate was exposed in installer material. CT records indicate a replacement key was issued March 16, 2026; production use and exploitation remain unconfirmed.
Key points
- The report says a private key was present in distributed installer material; cryptographic comparison found it matched the certificate for *.myclaw[.]360[.]cn.
- The certificate was a wildcard TLS certificate issued by WoTrus RSA DV SSL CA 2, covering the base domain and its subdomains.
- Certificate-transparency analysis indicates a replacement wildcard certificate with a new RSA key pair was issued on March 16, 2026.
- Passive DNS and registration data support the report’s attribution of the namespace to Qihoo 360.
- If the exposed key was trusted and an attacker could redirect traffic, it could enable service impersonation or interception; malicious updates and altered AI responses are described as potential risks, not observed activity.
- The report assesses that installer packaging or build controls may have included the key. Whether the certificate was used in production or an adversary obtained the key before rotation is unknown.
Article Details
- Attack Vectors
- The installer reportedly included the operational wildcard TLS certificate and private key, likely through a failure in build or packaging controls.
- If an adversary obtained the exposed key while the certificate remained trusted, they could potentially impersonate services across the covered namespace.
- With traffic redirected through DNS manipulation or network compromise, an adversary holding the key could potentially intercept TLS sessions and access credentials, tokens, or AI interaction data.
- Impersonated backend endpoints could potentially deliver modified updates or configuration files, or alter responses from Security Claw inference services.
- The article discusses prompt manipulation, model substitution, and data capture as possible scenarios; it does not report that these attacks occurred.
- Defensive Notes
- Rotate or revoke exposed certificates and keys; the article reports that a replacement certificate with new key material was issued on 16 March 2026.
- Prevent secrets from entering release packages through build and packaging controls, separation of development credentials from production artifacts, and automated secret scanning.
- Review certificate-transparency logs and passive DNS telemetry to establish the exposure timeline and scope.
- Determine whether the exposed certificate was deployed in production and whether an adversary accessed the key before rotation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 5a0a0df9695395223a1d342d2ccf82f449b342a281ed056dfa7880965bcbe3ca | SHA-256 fingerprint identifying the exposed operational wildcard TLS certificate; the article does not report malicious use of the certificate. |