Their Business: Rallying More Than 10,000 Hackers to Hunt for Holes Across the Internet

They are called Wooyun. You may never have heard of them, but the internet services you use have almost certainly appeared on their vulnerability lists.

"I went on a blind date through Baihe.com."

"How did it go? Any luck? Did you find someone?"

"I found their bug."

On September 6, a hacker discovered a vulnerability at the dating site Baihe.com that put the data of millions of users at risk.

This was not the plot of a hacker movie. The hacker, Croxy, did not pick up an encrypted phone and demand a ransom. He wrote the joke above and reported the security flaw to a vulnerability platform called Wooyun.

Baihe.com did not call the police either. Two days after the vulnerability was posted, the company confirmed it and began fixing it. Barring surprises, the flaw that threatened the information of tens of thousands of users will be closed within days, and in October Wooyun will publish exactly where it lay.

"Most vulnerabilities can probably be fixed in a week, but we give 45 days... For client software such as browsers and website-building systems, we give 90 days, so vendors have plenty of time to fix them," Meng Zhuo, founder of the Wooyun platform, told QDaily. Wooyun publishes the vulnerabilities so that the testing methods behind them flow back to the community and other internet security professionals can learn from them.

On the Wooyun platform, this happens more than a hundred times a day. In the last 15 days alone, 1,940 new vulnerabilities were added. And the flaws exposed there may well touch your life:

• In September this year, a vulnerability in Joyoung's smart soy milk makers was exposed. A flaw in their design and controls let anyone take control of any Joyoung soy milk maker. Joyoung learned of the problem, confirmed it and began repairs on the same day it was reported.
• In July 2014, a serious vulnerability at Alibaba was also exposed on Wooyun. With nothing but a search engine, and without even an account or password, anyone could pull up sensitive information on Alipay users: account balances, transaction records, shipping addresses, names and phone numbers. Once Alibaba learned of it, the company gave the white-hat hacker who found the flaw a reward of 50,000 yuan.

"Wooyun" and "white hats" are two names you cannot avoid in Chinese internet security.

Since Wooyun was founded in 2010, the vulnerability count on its listing pages has passed 70,000. The companies involved include tech firms such as Tencent, Alibaba, Baidu, Xiaomi and Lenovo, but also a number of Chinese banks and financial institutions, and even local government websites.

The content of this vulnerability community comes from its members: more than 10,000 registered "white-hat hackers." White hats are technically skilled people who love network security. Unlike traditional hackers, they usually tell companies about vulnerabilities and remind them to fix them, rather than exploiting them for personal gain.

"At the start we had no idea it would turn into what it is now," Meng Zhuo told us. In 2010 Jianxin (an online handle), who was then doing security work at Baidu, wanted more people in the information security industry to talk to one another and sharpen their skills together. So a group of friends in the industry built the "Wooyun vulnerability platform" in their spare time. The first users were themselves and the people around them; whenever someone found a vulnerability, they submitted it to Wooyun.

Wooyun handles vulnerabilities like this. When a white-hat hacker submits one, Wooyun notifies the affected vendor to claim it and discloses the details only to that vendor, so it can fix the problem quickly. Forty-five days after the report (90 days for services such as browsers and social apps), Wooyun makes the details public, and the method used to find the flaw becomes study material for the white-hat community. The white hat who supplied the vulnerability earns Wooyun's virtual currency and moves up in rank.

Under this model, Wooyun defines itself as a non-profit third party independent of every company. But the model is not easy to run.

"Security is a very closed industry," Meng Zhuo said. "When someone else finds a vulnerability in your company, that's actually very bad news, because there's a good chance the black market will exploit it."

That is why many large tech companies, such as Microsoft, Facebook, Yahoo and Alibaba, not only keep their own security teams but also run their own vulnerability platforms or bug-hunting contests. The aim is to recruit outside hackers to find flaws for them and to pay a set amount of prize money to whoever finds one. The details of each vulnerability belong to the company alone and are never made public.

Last year Google, too, tried to build a third-party vulnerability platform similar to Wooyun, Project Zero. But after it published vulnerabilities in products from its competitors Microsoft and Apple, it drew accusations of unfair competition. Google is itself a major player in the industry, so its rivals' wariness is understandable.

Wooyun's early troubles and its later success came from the same source: it belongs to no company.

The industry's closed nature also grows out of a stereotype of hackers: people who use high-tech means to break into websites and steal information, and who, if a company won't cooperate, send its confidential data into the black market. In China and abroad alike, trading in stolen information is a crime.

Yet not everyone skilled with networks has ties to the black market. The "white-hat hackers" Wooyun so often mentions are technically skilled people who love network security, and they usually hand vulnerabilities to companies rather than exploit them for personal gain.

In the early days, though, companies reasoned backwards. When a white hat announces on Wooyun that a vulnerability exists without revealing the details, that is an early warning that gives the company time to fix it. Real attackers never leave a window for repairs. Reporting a vulnerability this way is good for a company's security, which is why so many companies encourage white hats.

But at the time, because the public held this stereotype of hackers and did not understand information security, Wooyun was shut down twice, in 2011 and 2012.

In December 2011, news spread online that the developer community CSDN had been hacked: 6 million user accounts and their plaintext passwords had leaked, and user data was circulating widely. A white hat on Wooyun had already submitted a related vulnerability. Less than three days after the CSDN incident, another white hat on Wooyun submitted a vulnerability involving the leaked data of 40 million users of Tianya Club.

These two vulnerabilities suddenly put Wooyun's name before the public.

"Neither the authorities nor internet users were ready when it came out. People's trust in corporate information security collapsed overnight. They found it terrifying that strangers might know their names and other personal details," Meng Zhuo recalled.

With the public uneasy, and the government suspicious of the hacking industry and of Wooyun's motives, Wooyun announced a temporary shutdown just a week after the incident.

The second shutdown came in 2012, after Wooyun exposed a serious vulnerability at a telecom operator's branch in a prefecture-level city. The operator demanded that the vulnerability be deleted, and Wooyun refused. Then its "network cable was pulled," and even the site's official registration record vanished.

Meng Zhuo said that since the site's founding they had set a few rules. Besides publishing vulnerabilities after 45 days, there was "no deleting vulnerabilities." "We have our ideals too. Once a vulnerability passes our review, we won't delete it because of pressure or for any other reason. We owe that to the white hats who submit them: what they've submitted won't vanish for no reason, their work won't go to waste, and they won't be threatened."

After the shutdowns, though, Meng Zhuo felt helpless. For a newborn vulnerability platform like Wooyun, every step was a struggle.

"That's when we started to feel how weak we were on our own," Meng Zhuo said. In 2012 they approached the Internet Emergency Response Center about working together, and Wooyun became a third-party, non-profit civil organization.

At the time, the Internet Emergency Response Center had its own public vulnerability platform, CNVD. It also wanted to collect vulnerabilities, but as a government agency it had not drawn many white-hat hackers into its project. Wooyun arrived at just the right moment to take on some of the work of the "National Information Security Vulnerability Database" for CNVD.

"With some vulnerabilities, if we notify the company ourselves, it may not do anything. But working with CNVD, they can push these things through from the top down."

With official accreditation and the national emergency center as a partner, the Wooyun team could focus more fully on its white-hat community. It wanted to give Chinese hackers a positive incentive: submit vulnerabilities and push vendors to patch them, and in return earn the community's virtual currency and higher rank, plus, for having fed the community, more chances to talk with and learn from top security experts.

"If it weren't for Wooyun, I might never have gone in this direction. Saying it changed my life sounds like an exaggeration, but it really did," said "Little K," an 18-year-old white-hat hacker who started teaching himself the basics of computing, and how to break into a website, three years ago.

"When you work on technology alone, your understanding of it is very limited. After I found Wooyun, what I knew spread from isolated points to a whole field, and the loneliness slowly faded." Little K joined Wooyun last year and is now helping with internationalization work for the Wooyun knowledge base.

Little K is not an exception. ZPH, who is only in his third year of junior high, found a vulnerability at the Tianhe-1 supercomputer center this year that made it easy to get into the internal network, and it suddenly brought him a lot of outside attention. Since 2014 he has submitted more than 40 vulnerabilities on Wooyun, and his mother is comfortable with it. "I think Wooyun guides (white-hat hackers) very well. This year I let him go to Wooyun's annual conference on his own," she told us.

A promotional image for the 2015 Wooyun conference

More than 10,000 white-hat hackers have now registered on Wooyun. Once they had gathered there, some vendors began to embrace the platform of their own accord.

"Every new product we've built, vendors pushed us into," Meng Zhuo said. In recent years, besides running and growing the vulnerability platform, the Wooyun team has been building other products. "If it were only verifying vulnerabilities and maintaining the platform, four or five people checking in each day would be enough," Meng Zhuo said. But Wooyun's office holds more than 20 other young people, each busy with a different product beyond the vulnerability platform.

One of these projects is "Crowdsourced Testing", which the Wooyun team began trying out in 2012 as a more direct way for white hats to earn money.

Meng Zhuo said this demand, too, came from vendors on the platform. For now, only fairly large internet companies can afford to hire security teams; for small and mid-sized startups, network security is hard. So Wooyun set up projects like this one: a company that needs testing posts the task on Crowdsourced Testing, Wooyun matches it with suitable white-hat hackers, and the company pays them according to how severe each vulnerability they find is.

"Think of it as a panel of expert doctors, made up of white-hat hackers, examining you," Wudi, a partner at Wooyun, told us. Wooyun's official materials list Zhihu, Lenovo, Baidu and a number of other companies among Crowdsourced Testing's clients.

Beyond Crowdsourced Testing, "what they asked us most back then was whether we could help them hire people," Meng Zhuo said. Since vendors and white-hat hackers wanted the same thing, in 2014 Wooyun launched its first product outside the vulnerability platform, "Wooyun Recruitment." It is very simple: companies post job listings, and interested white-hat hackers apply. "Even if we didn't do this, many vendors hiring network security staff would ask these white hats directly for their IDs, their rank and how many Wooyun coins they have. That's how they judge their ability."

This summer Wooyun also launched the "Tang Dynasty Security Patrol" service, which looks like a much more mature model. Wudi said they hope to use it to reach companies with long-term security needs and offer them a more standardized service: regular security check-ups, plus a search of all the company's existing internet "assets," including servers it bought online in the past.

They will also ask white-hat hackers to write up their methods for finding vulnerabilities as guidance for vendors, and if a vendor adopts a method, the white hat gets a cut.

Yet none of these commercial products has an entrance on Wooyun's main site. The team does not want them to disturb its original users. "We want only the people who already know we offer this service to go looking for the new product," Meng Zhuo told us.

Profit and money matter less, Meng Zhuo said. "The white hats are what matter most."