WooYun

» see wooyun.org as it lived, on the wayback machine

~ the last words ~

For nine years wooyun.org served a page with two characters on it, 升级中, meaning under upgrade. No header and no navigation. The 2 August 2016 capture has it and so does the 21 January 2021 capture, unchanged, and by the June 2025 capture it had been replaced with two different characters saying the domain had expired. The site never reopened and the notice never came down. The registration did.

WooYun opened in May 2010 with the domain registered on the sixth. It described itself as a free and equal platform for reporting vulnerabilities. In practice that meant a researcher who found a hole in a Chinese company's website posted it there, publicly, and the company read about it at the same time as everyone else. There was no bug bounty industry in China then to route it through, and no settled law saying whether looking for the hole had been allowed.

It worked at scale for six years. An academic study of the platform counted 3,254 researchers submitting 16,446 verified vulnerabilities up to January 2015, and by 2016 the reporting put over seven thousand registered security people on it. It was the largest thing of its kind in mainland China and the default place a Chinese white hat went.

Then on the evening of 19 July 2016 the police took the senior management. It happened without notice and without any administrative procedure, and people inside WooYun did not know it was coming. The next day the site posted that it was upgrading and would reopen shortly, with a line telling readers to put their faith in WooYun rather than believe rumors. Nobody has explained it since.

~ the record ~

~ the question underneath it ~

The founder was Fang Xiaodun, a former Baidu employee, working with a co-founder known as Meng De. What they built sat on top of a question China had not answered and mostly still has not: when a researcher demonstrates a hole by pulling a few records out through it, is that a proof or a theft?

The case that made the question concrete arrived the year before the shutdown. A researcher named Yuan Wei reported an SQL injection flaw in the dating site Jiayuan.com in December 2015. The company thanked him publicly, then reported him in January 2016 for taking more than nine hundred rows of personal data out through the hole he had just disclosed. He was detained in April. His account was that the extraction was what the automated tool did on its own.

~ the night of the nineteenth ~

Ten people connected to the group were reportedly taken in. The immediate trigger, according to Chinese reporting at the time, was a complaint from a company whose data a researcher had pulled while reporting a flaw through the platform. The wider account is that Chinese companies had lost patience with having their holes published, and WooYun was where the publishing happened.

The Wall Street Journal noted that it was unclear whether the government had closed the site or its own operators had, which was the honest position then and still is. Other theories put it on vulnerabilities found in government systems. None of it was confirmed, and that absence is part of how this kind of closure works: there was no order to read and nothing to appeal.

~ the long tail ~

I can only read this one from outside, and the barrier is language before it is anything else. In 2016 i was a computer engineer following English-language security writing, and the Chinese research community published in Chinese on Chinese platforms, so the largest disclosure board in the world's largest internet market was invisible to me the whole time it was alive. I found the shape of it in the archive, nine years after it stopped.

What a researcher has now is a vendor-run reporting channel, where the company that owns the flaw decides what gets published and when. That is a safer arrangement for everybody involved and it is not the same arrangement. The open board, where the finder and the owner read the same page on the same day, is what closed on 20 July 2016.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »