OLolalonde·Oct 20, 2013
Strangely, the whole GoAhead code including the backdoor seems to be on Github: https://github.com/socoola/yhrouter/blob/master/user/goahead...
In From China, With Lovesocoola
yhrouter
HISTORICAL RECORD2013–2013
socoola / yhrouter · Not publicly available
yhrouter
Discover this repository through its Hacker News conversations.
4Distinct people
4Mentions
0Explicit recommenders
What to know before exploring
What it is
A public description has not been verified.
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by hour4 dated mentions
Observed mentions: 2013-10-19 17:21:55 UTC to 2013-10-20 02:31:47 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Oct 19, 17:00 | 2013-10-19 17:00:00 UTC | 2013-10-19 18:00:00 UTC | 1 | 1 | 0 |
| Oct 19, 18:00 | 2013-10-19 18:00:00 UTC | 2013-10-19 19:00:00 UTC | 2 | 0 | 2 |
| Oct 19, 19:00 | 2013-10-19 19:00:00 UTC | 2013-10-19 20:00:00 UTC | 0 | 0 | 0 |
| Oct 19, 20:00 | 2013-10-19 20:00:00 UTC | 2013-10-19 21:00:00 UTC | 0 | 0 | 0 |
| Oct 19, 21:00 | 2013-10-19 21:00:00 UTC | 2013-10-19 22:00:00 UTC | 0 | 0 | 0 |
| Oct 19, 22:00 | 2013-10-19 22:00:00 UTC | 2013-10-19 23:00:00 UTC | 0 | 0 | 0 |
| Oct 19, 23:00 | 2013-10-19 23:00:00 UTC | 2013-10-20 00:00:00 UTC | 0 | 0 | 0 |
| Oct 20, 00:00 | 2013-10-20 00:00:00 UTC | 2013-10-20 01:00:00 UTC | 0 | 0 | 0 |
| Oct 20, 01:00 | 2013-10-20 01:00:00 UTC | 2013-10-20 02:00:00 UTC | 0 | 0 | 0 |
| Oct 20, 02:00 | 2013-10-20 02:00:00 UTC | 2013-10-20 03:00:00 UTC | 1 | 0 | 1 |
What Hacker News says
4 sourcesLooks like here is where it gets interesting:
https://github.com/socoola/yhrouter/blob/master/user/goahead...
An example fo the inbound command structure, then code further below to execute it and respond.
It listens on the LAN interface (assuming the value shown is what it says it is) for datagram requests. Unless I'm missing something, that seems to indicate an attacker must already be on the same network.
It does shell out the commands it receives - so perhaps more interesting would be look and see what kinds of accessible binaries and scripts ship on the device.
In Source code for backdoor found in Tenda routerhttps://github.com/socoola/yhrouter/blob/master/user/goahead...
I'm no security export, but what this is doing is creating a UDP socket (SOCK_DGRAM) that expects commands to be executed (using call_shell()). It then replies with the output back to the sender of the UDP packet.
In Source code for backdoor found in Tenda routerSource code for backdoor found in Tenda router
15 points · Open discussion