Shadowing Practice: Exposing The Flaw In Our Phone System - Learn English Speaking with Video

בחר מצב תרגול

כל מצב פותח חדר תרגול במסך מלא.

413 משפטים

אם המשפטים קצרים או ארוכים מדי, לחץ על ערוך כדי להתאים אותם.

This is Linus from Linus Tech Tips and we hacked the phone network in order to spy on him.

That's pretty messed up, Derek.

I slept easier not knowing that.

We intercepted his phone calls and stole his two-factor passcodes.

Is that your number, Linus?

Yeah, but I didn't get.. mine didn't even ring.

We didn't touch his phone, we didn't send him an email or a text, nothing.

We did it all remotely.

And the worst part is, it could happen to you.

I think I'm really surprised that, no offense, but like, you guys did it.

You know?

Well, you're not a career criminal hacker mastermind, necessarily.

No, indeed.

But here it is, a normal looking and feeling device with no,

you know, obvious problem with it, and you just.. receive my call instead of me receiving it.

Just what, like on command?

You just, it's an app on your computer or what?

I don't even know.

But before we explain how we did all that...

The first startup that Steve Jobs and Steve Wozniak made wasn't Apple.

No, they were tackling a different problem, one where their product was actually illegal.

So back in the 1970s, long-distance phone calls were really expensive.

Adjusted for inflation, a call from New York to London could run you $25 a minute.

So these two entrepreneurs created a little blue box.

And what it did was it hacked the telephone network.

They could trick the telephone company into connecting the calls for free, among other things.

We were young, and what we learned was

that we could build something ourselves that could control billions of dollars worth of infrastructure in the world.

I don't think there would have ever been an Apple computer had there not been blue box.

Wasse said you called the Pope.

Yeah, we did call the Pope.

Wasse pretended to be Henry Kissinger.

And we got the number of the Vatican and we called the Pope.

They started waking people up in the hierarchy, you know, I don't know, cardinals and this and that.

And they actually sent someone to wake up the Pope

when finally we just burst out laughing and they realized that we weren't Henry Kissinger.

But how were they able to do all of this with one electronic box made from Radio Shack parts?

Until the mid-1920s, most phones had no way of dialing.

When your phone was on the hook, about 48 volts was connected from the exchange to your phone.

Then when you lifted the receiver, an internal circuit connected the speaker and microphone, drawing power, and that caused the voltage to drop to around 10 volts.

And at the telephone exchange, this drop turned on a light bulb, alerting the operator who would then pick up and ask who you're calling.

Boston?

Sir?

Get me the Bluebird Diner.

And after consulting a directory, they would connect a wire between your line and your friends.

Manually connecting calls was labor-intensive.

Operators had to handle hundreds of connections per hour.

In 1910, one pundit said, the telephone system will need to employ every working-age woman in the country as an operator.

By 1950, there were more than a million of them in the US alone.

To reduce costs, companies sought to automate the call connection process, and one solution was the rotary dial telephone.

To use it, you place your finger in a number hole, rotate it to the end, and the dial rotates back.

And on the inside, a metal disc with ridges turns.

Each ridge pushes two metal plates into contact, completing the circuit to the exchange.

The dial sends pulses to match each number.

For the number two, it sends two pulses.

For the number three, it sends three pulses.

This goes on up to ten pulses for the number zero, which is why zero is at the far end of the dial instead of beside the one.

Those pulses that travel down the phone line, they determine how your line is connected.

So they're known as control signals.

But as the length of the transmission line was increased, so did its capacitance and resistance.

And this caused the clear input signals to become distorted, smoothing out voltage changes.

So now the pulses couldn't trigger the switching at the exchange.

While this wasn't a problem for local calls, it made automating long distance almost impossible.

Now, all phone lines, including long-distance ones, were built to carry sounds in the human voice and hearing range, mainly from 300 to 3,400 hertz.

So why not use this built-in capability to carry control signals?

To do this, phone companies introduced the touchtone or push-button telephone.

On a keypad, specific frequencies were assigned to the horizontal axis and the vertical axis,

so that each button was uniquely identifiable by the combination of two tones.

By sending control signals within the voice band, all telephone networks could receive it using their existing systems, independent of distance.

But with this innovation came an opportunity for Jobs and Wozniak to exploit.

When you made a long-distance call, it was first routed to a central node.

This node communicated with a remote node, and they determined if a line was free by checking whether both sides were sending a 2600 Hz tone.

So Jobs and Woz exploited this.

First, they would dial a toll-free 1-800 number, which would get them into a local node.

and then they would send a 2600 Hertz tone into the phone.

This would trick the remote node into thinking the call had been disconnected.

So the remote node would start playing the 2600 Hertz tone again, but Jobs and Woz were still on the line and when they stopped playing the tone on their side,

the remote node assumed a new call was being placed.

By sending a key pulse tone, followed by the desired phone number and ending with a start tone,

they could connect to any long-distance number for free, as the home node still believed it was connected to a toll-free number.

The vulnerabilities in the signaling system were obvious.

To mimic the 2600 Hertz tone, some people would even use a toy whistle from a Cap'n Crunch cereal box.

It just happened to make that frequency.

The telephone companies clearly needed to develop a new signaling protocol, and their solution was to use a separate digital line for carrying control signals.

That way no one could control the network by sending tones down the voice line, because it no longer controlled how the call was connected.

This new protocol was called Signaling System Number 7, or SS7 for short, and it's still broadly in use today.

But it may not be as secure as people thought.

Princess Latifa of Dubai claimed that her father, Sheikh Mohammed, the ruling emir had held her in solitary confinement in the dark, beaten and sedated for several years.

In late February 2018, her Finnish martial arts instructor Tina helped her escape.

They fled to a yacht captained by former French intelligence officer Hervé Jaubert.

For eight days, they sailed toward India.

Latifa was hopeful, but it wasn't to last.

Late on the night of March 4th, a dark boat pulled up alongside.

It was sent by her father.

Laser sights pierced the smoke as agents boarded the yacht, abducting Latifa and taking her back to Dubai.

But how did they find her?

Well, the captain had been the victim of a coordinated SS7 attack, one aiming to pinpoint his location and,

by extension, the whereabouts of the princess.

And I'm going to show you how, using the exact same steps to spy on my friends.

100

With their permission, of course.

101

This is Karsten Nohl and Alexandre de Oliveira.

102

They are cybersecurity specialists who are helping me spy on Linus.

103

We took three steps to spy on him.

104

First, you have to infiltrate SS7.

105

Second, gain trust.

106

And third, attack.

107

Of course, the main reason any of this is possible is step one.

108

When SS7 was introduced in 1980, mobile phones barely existed.

109

They were so big that they were mainly just used as car phones.

110

But things changed quickly and the number of mobile phones in the world exploded.

111

Roaming is one of the main use cases of SR7.

112

Say Derek, you visit me over here.

113

Your phone would try to connect to a network that's foreign

114

and that network would then have to reach out to your home network in Australia asking, is this a valid customer?

115

Are you willing to pay for the charges that they'll incur on my network?

116

And all of that information is exchanged over SS7.

117

For this to work, telcos need to communicate with each other.

118

So the way they do that is by making sure they're part of the same club.

119

The way they share membership to to this club is by using unique addresses to identify where requests are coming from.

120

SS7 is a global network, just like the internet.

121

And like on the internet, you need some addressing scheme.

122

So you need some way of saying this is me and this is you.

123

And on the internet we use IP addresses, on SS7 we use what's called global titles, GTs.

124

So to provide global roaming coverage, telcos typically establish agreements with two providers in each country they serve, one primary and one backup.

125

Telcos generally accept messages only from global titles with which they have agreements.

126

The whole system is designed to be a closed network with few barriers once inside.

127

This is known as the walled garden approach.

128

So this system seems pretty secure, and it was.

129

When SS7 was developed in the 80s, the telecommunications landscape was dominated by a few large, reputable operators.

130

These operators had established relationships and mutual interest in maintaining the integrity of the network.

131

But 45 years on, the landscape has shifted dramatically.

132

Now there are over 1200 operators and 4,500 networks, many of which need SS7 access,

133

from virtual network operators to mass tech services sending Uber Eats notifications.

134

There are so many more players in the garden that not all of them are trustworthy.

135

Those companies, some of them sell services onto third parties, some of them can be bribed, some of them can be hacked.

136

So there's probably thousands of ways into SS7 at reasonable effort or cost.

137

How much are we talking?

138

Like, how much would it cost to buy access to SS7?

139

Buying a single SS7 connection isn't that expensive.

140

We're talking a few thousand dollars per month.

141

The people who do sell access, I mean, why would they do it?

142

People sell SS7 access for one reason, money.

143

And thanks to global agreements between providers, accessing a trusted GT is like gaining access to all the GTs they have partnerships with.

144

We even saw the invoice of a valuable US-based GT being leased illegally for $13,000 a month.

145

Are you buying access to SS7?

146

I'm paying for access to SS7, yes.

147

And we do that because we do SS7 security tests,

148

so we need to be in a similar position as real hackers to get near real results.

149

So step one, infiltrate SS7 is complete.

150

On to step two, gain trust.

151

Hackers today can try many different things once they've scaled the wall into the garden.

152

But you need more than just SS7 access and a phone number to attack.

153

Even a trusted GT and the phone number of the target isn't enough to uniquely identify them.

154

No, you need something from the SIM card.

155

The real key in a mobile network is a unique 15-digit identifier which belongs exclusively to the SIM card on the phone.

156

It's called an International Mobile Subscriber Identity, or IMSI for short, and it is very important.

157

Basically, to be able to collect the IMSI from a subscriber,

158

we would launch some of the messages such as send routing info or send routing info for SN.

159

These messages are normally used to collect the IMSI.

160

Networks have firewalls in place that will deny some requests if they look suspicious.

161

Getting an IMSI is crucial to appear trusted.

162

So let's move on to the critical step three, attack.

163

Do you want to just like try the phone?

164

Is there anything you can try to see if it works?

165

Like call someone or text someone?

166

Sure, I'll call my wife.

167

Does she normally pick up?

168

Yeah, she'll probably pick up.

169

Hello?

170

Hello, Yvonne.

171

This is the voice of your husband.

172

I would like to talk to you about the payment.

173

Um, okay, hi.

174

No, no, it's me, it's me!

175

Did she hang up on you?

176

Yeah, yeah, she did.

177

So we've established the phone works as a completely normal phone.

178

Do you have any important calls coming up?

179

I don't know if I'd say it's important, but I'm on my way to Creator Summit tonight, and James from Hacksmith was gonna call me, and we're gonna kind of make some plans.

180

Uh, I'm getting a call right now.

181

Are you getting a call?

182

No. Hello, this is Linus.

183

Hey Linus, it's James.

184

How's it going?

185

It's going really well.

186

How are you?

187

Pretty good.

188

Am I going to see you at the YouTube Summit?

189

Yes, I'm really looking forward to that.

190

And man, do I hate Macs.

191

I feel like that's your persona, man.

192

You can't game on a Mac.

193

Uh, Linus, you want to talk?

194

I would like to talk, but I never got the call, so...

195

What number did you dial?

196

4473 Is that your number, Linus?

197

Yeah, but I didn't get- mine didn't even ring.

198

I heard it ring, but I heard it through my speakers on my computer, because I assume it went to your phone then.

199

That's right.

200

Or did it go to your computer?

201

No, yeah, it went to everything of mine.

202

So, yeah, James, I don't know.

203

You called Linus and it went to me.

204

Thank you for taking part in this weird demonstration.

205

There is absolutely nothing here to indicate that I was supposed to receive a call.

206

Yeah.

207

And I mean, the crazy thing is that's like a regular Canadian SIM card in there.

208

So, any Canadian SIM card, in theory, could be vulnerable to such an attack, where, you know, someone dials your number and it just doesn't go to you.

209

This is like, freaking, but on a completely different level.

210

That's exactly it!

211

Now, I'm familiar already with the concept of SIM swapping, where you social engineer a way to get a SIM

212

that is registered to someone else's account actually had accounts stolen that way in the past.

213

But in this case, my phone still works.

214

Hey, so the demo we're doing is pretty trippy hun.

215

Basically, they had Hacksmith call me, my phone didn't ring at all,

216

and instead Derek from Veritasium picked up the phone call and was able to talk to him, and Hacksmith had no idea that he called me and then...

217

Sorry, I'm with Cindy.

218

Oh, oh, hi Cindy.

219

Oh, you're not a speaker.

220

Okay, that's fine, just tell Cindy hi for me.

221

Okay, bye.

222

So how are we able to seize control of Linus' number like that?

223

When you put a phone number in your address book, you often don't put the country code.

224

But then if you're in a roaming scenario, that phone number would connect to a completely different person in the country you are currently in.

225

So it does make sense to basically overrule people's choices as to whom they're trying to dial

226

because they're not going to triple check each time whether their address book entries have country codes in them.

227

This is a powerful function.

228

By tricking the network into thinking his phone is roaming, we can rewrite the number he is calling to a number that we control.

229

And so what I did at the end was when I received this message,

230

I sent back your number that you can see here was your US-based number.

231

So even if you were located in Australia, I was still able to forward the call to you on your US number in Australia.

232

That's amazing, you just try a few times and then it works, right?

233

Yes.

234

It's not always that simple.

235

But this time it was quite difficult.

236

So the most important question I have now then is, what did you need to steal from me in order to become me?

237

Like, is this something you can social engineer out of my carrier?

238

Is this something that I would need to accidentally leak a screenshot of my IMEI?

239

At the very simplest, all we would need is your phone number.

240

That's it.

241

You could even do something where I could act as a middleman where I would reroute the call to me,

242

but also simultaneously, I would dial for you the real number and I would send you through to them.

243

And then I can sit on the line and just record that call.

244

Yikes.

245

But this isn't the only attack.

246

We can do a lot more with SS7.

247

We can also intercept text messages as part of our suite of attacks.

248

Similar to phone calls, we can trick the network into thinking the target is roaming, which reroutes their messages to our GT.

249

We can then steal one-time passwords used in two-factor authentication.

250

This type of attack works until the subscriber interacts with their phone network, at which point the phone reconnects to the correct GT.

251

But you need a few seconds only to hack into somebody's account, of course.

252

You need that few-second window to receive the one-time password.

253

So we actually set up a new Linus YouTube channel.

254

Okay, so theoretically, he could get this username and password via a dump

255

because I'm a butthead and I use the same username and password across different accounts.

256

Or he could install a keylogger on my system he could get it that way when I'm typing it in.

257

So then I verify my number, but of course he has my number because that's realistically not that hard to find.

258

And theoretically, I'm supposed to get a two factor code right now, except...

259

I got it.

260

820299. I'm in.

261

He's in, he hacked the mainframe.

262

Wild, hey?

263

Yep, we can hack your YouTube account.

264

I'm going to start posting science videos on Linus Tech Tips.

265

Oh, that's okay.

266

I'm sure they'll get like 30 million views or whatever, so I'll be fine with it.

267

Thanks for the AdSense.

268

Deal.

269

And you could see the code right there.

270

Exactly.

271

So you could see it at the bottom, 820299.

272

So basically, once the interception is running, then I would receive any SMS sent.

273

He would never have known that he missed those messages or that they were intercepted.

274

Exact.

275

Wow.

276

Yeah, this seems pretty serious.

277

I mean, SMS two-factor authentication is almost the default, right?

278

Unfortunately, yes.

279

It's not only the default, but in some cases it is the only available option.

280

And sometimes that can even be for accounts that should be treated with the utmost of care, like a bank account.

281

There's a third method of attack that we weren't able to show Linus.

282

Lucky for him, his network blocked the requests.

283

On many networks, you can use the IMSI number

284

and the switching center info we harvested in step 2 to send a command deeper into the network.

285

By targeting the switching center where the device with the IMSI is connected, we can issue a command routinely used for legitimate purposes, such as routing and forwarding calls,

286

or providing emergency services based on the device's location.

287

Using this request, we can track a target's location.

288

It's not as hard as you'd think.

289

SS7 doesn't even rely on GPS to locate someone.

290

In fact, it was invented before GPS was even in public use.

291

One way to do this is if a target is in range of multiple cell towers, their location can be narrowed down to where the signals overlap.

292

The more towers in range, the more precise the location.

293

A more accurate method measures the time it takes for signals to reach a phone from three towers.

294

By calculating the distance based on transmission speed, we can pinpoint an exact location on a 2D plane.

295

But SS7 attacks don't use either of these methods.

296

They try to be subtle.

297

An SS7 location request simply identifies the cell tower the target is connected to.

298

In an urban area with many towers, this can place them to within 100 meters.

299

You will definitely know which city block somebody is in.

300

And if you wanted to, for instance, find out whether they're at home or at work, this is a great way to do it.

301

Yeah, that's a little bit scary.

302

In 2016, Karsten and his team used this method to track US Congressman Ted Lieu.

303

The Congressman has been in California, more specifically the LA area.

304

Let's zoom in here a little bit.

305

So that is how we did it.

306

We executed three steps.

307

We infiltrated SS7, gained trust and attacked.

308

We intercepted Linus' phone calls and text messages.

309

I'm not sure he was as excited about it as I was.

310

This is why we can't have nice things.

311

Up until now, this has just been a bit of fun.

312

I've demonstrated these attacks on a friend of mine.

313

But the threats are real, and they can have devastating consequences.

314

They will kill her, the captain texted shortly before Latifa was abducted.

315

His phone was the target of an SS7 attack that involved all three of the steps we explored.

316

To start, the attackers had leased multiple GTs in different countries.

317

Then the following all happened in a five minute window.

318

First they sent at least seven separate requests aiming to get the captain's IMSI from his US based operator.

319

When that didn't seem to work, they followed up with at least four location requests.

320

So did it work?

321

Well, all of these requests were blocked by firewalls.

322

That's why we have all the details.

323

But there was a sixth GT we haven't shown, this one nearby in the US.

324

We have no information about the requests on this GT because they likely weren't stopped.

325

We spoke with Crofton Black, the investigative journalist who revealed the SS7 exploits in this story, and this is what he told us.

326

It's a brilliant example of SS7 involvement because it illustrates a classic, sophisticated pattern of attack.

327

Multiple GTs in multiple countries, it's a textbook example of telco penetration risks.

328

Though because the Emiratis were also using other software like Pegasus and other hardware like spotter planes,

329

we can't say that any single one of these was the thing that led to her being found.

330

But the evidence is damning, and SS7 is used pretty widely.

331

Criminals have used SS7 to intercept SMS two-factor authentication codes and empty millions of dollars from bank accounts.

332

For some, SS7 is just the first step.

333

The NSO Group, a notorious Israeli cyber surveillance firm, acquired an SS7 tracking company in 2014.

334

NSO is the company behind Pegasus, a spyware tool that gains complete access to targeted phones without a user clicking anything,

335

embedding itself and erasing traces of entry.

336

Such zero-click hacks are costly.

337

They can cost more than $4 million per exploit.

338

Before NSO commits resources targeting specific software or vulnerabilities on a phone, first they gather basic data, like device type and software version,

339

to make their lives easier.

340

And as you've seen with SS7, this isn't hard.

341

One expert we spoke to tested a foreign network and found 20 to 30 VIPs were constantly under surveillance there,

342

including the country's chief of cybersecurity.

343

Accurate data on tracking is difficult to come by, but another expert provided evidence of more than two and a half million tracking attempts per year,

344

though they reminded us that the people being targeted are generally those of interest to state agencies.

345

Now, we couldn't find data on interception attempts, but luckily experts told us this is far less common.

346

So millions of malicious SS7 requests are sent each year, but it used to be even worse.

347

To request location over SS7, you used to be able to send a command without even knowing the IMSI, and the network would just provide it to you, no questions asked.

348

The classical example is the anytime interrogation request, which as the name already suggests is kind of a creepy command.

349

I don't believe there is ever legitimate purpose for one network to send this command to another network interrogating about their customers.

350

Karsten Noll and fellow security researcher Tobias Engel exposed these vulnerabilities publicly in 2014.

351

The SS7 research that was disclosed in 2014 was a wake-up call to the industry.

352

Most people had heard rumors that SS7 tracking and spying was possible, but they hadn't really seen hard evidence of it, and especially how easy it is.

353

That a ragtag gang of hackers from Berlin with very amateur means can do any type of SS7 hacking that they want.

354

After their conference, all of the German telcos immediately started refusing these requests.

355

Anytime integration is the first SS7 command everyone stopped because it was abused a lot and never used constructively,

356

but there is over 150 other messages that need to be stopped as well to make SS7 be completely secure.

357

So if there are so many ways to abuse SS7, why haven't we gotten rid of it?

358

Well, because it's the backbone of 2G and 3G communications.

359

So what if we phase out 2G and 3G?

360

that has caused problems.

361

Since 2018, cars in the EU are equipped with mandatory emergency call buttons that trigger in an accident.

362

They need a SIM card to work.

363

And to cut costs, guess what auto manufacturers are using?

364

That's right, 2G and 3G SIM cards using SS7.

365

You have to have that legacy support or when 4G connectivity drops, you have absolutely nothing left.

366

Dude, the number of times that I'm on 3G, not insignificant.

367

And I'm in a metropolitan area.

368

What's surprising of course is

369

that there hasn't been a global push yet to replace SS7 with one of the two newer versions of the technology,

370

the latest of which that was introduced with 5G, seems pretty secure, but that's now a problem of first mover disadvantage.

371

So because of the the network effects, you get nothing out of adopting a technology as the first guy.

372

You want to be the last one when everyone else is already connected

373

and you get the full benefit from also joining the club.

374

So even though the 5G signaling protocol can stop the attacks completely, and many networks are using 5G technology on their networks, when routing calls between networks,

375

SS7 is still the de facto standard.

376

You create a tremendous amount of inertia, to use a term that's probably more your channel than my channel, that makes moving on extremely difficult.

377

So unless there's some new major events that put this back on the public radar, it could be another 10,

378

15, maybe even 20 years until SSF networks are finally switched off.

379

What's crazy is that we exploited these vulnerabilities and I'm just a YouTuber.

380

I did have the help of some excellent security researchers, but I'm surprised at how easy it all is.

381

Now imagine if I had the backing of a government.

382

This is a real problem.

383

So what can you do to protect yourself?

384

On the personal side, as long as you have a SIM card, unfortunately there's not much you can do about location tracking.

385

If possible, choose alternatives to SMS-based two-factor authentication, so messages can't be intercepted.

386

Use an authenticator app or hardware tokens.

387

And if you're worried about phone tapping, use encrypted, internet-based calling services like Signal or WhatsApp.

388

We've been told this is mainly used on people of interest.

389

So should it really matter to you?

390

SS7 is a huge privacy intrusion and there's millions of abuse cases every single month.

391

Whether privacy intrusion is a problem for everyone individually, of course, is almost a philosophical question, right?

392

Somebody who grew up more in the Berlin tradition of the Chaos Computer Club, like myself, strongly believes that privacy

393

and the ability to kind of form your own thoughts without being observed is a prerequisite for democracy.

394

But many other people would argue, nothing to hide, nothing to fear.

395

Our technological world will never be perfect.

396

By the time we secure or replace SS7, vulnerabilities will already have been found in the new system.

397

But luckily, there's an easy way to be ready for whatever the future holds.

398

Build your knowledge and problem solving skills a little bit every day.

399

And you can start doing that right now for free with this video's sponsor, Brilliant.

400

Brilliant has thousands of interactive lessons where you can learn by doing, making you a better thinker and problem solver.

401

You build real skills in everything from math and data analysis to technology and programming, you name it.

402

Brilliant is designed to be uniquely effective.

403

Their first principles approach helps you build understanding from the ground up, so you'll not only gain knowledge of key concepts, you'll learn to apply them to real-world situations, all while building your intuition,

404

giving you the tools to solve whatever problems come your way.

405

Brilliant's new course on data clustering, for example, equips you with the same tools security researchers like Karsten used to spot trends among the billions of SS7 messages.

406

This is really helpful when hunting hackers, but the concepts you'll learn also help navigating a world where

407

data influences everything from what movies are being recommended to national politics.

408

And one of the best things about Brilliant is since every lesson is bite-sized, you can build your skills and sharpen your mind whenever and wherever you have a few minutes,

409

helping you build a daily learning habit that sticks, the opposite of mindless scrolling.

410

To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash Veritasium.

411

Or you can scan the QR code or click that link in the description.

412

You'll also get 20% off an annual premium subscription.

413

So I wanna thank Brilliant for sponsoring this video, and I wanna thank you for watching.

הורד אפליקציה

כל מה שאתה צריך כדי לדבר בשטף

הגיית AIציון לכל משפט

תרגול IPAשלוט בכל צליל

אוצר מיליםבנה את מאגר המילים שלך

משחק אוצר מיליםלמד תוך כדי משחק

סרוק QR

Download on theApp Store Get it onGoogle Play

אותו ערוץ

FOR YOU

המלץ על סרטון

47 משפטים

The most interesting "hack" in history...

Business EnglishUniversity StudentsWorking Adults

123 משפטים

Steve Jobs introduces iPhone in 2007

Business EnglishUniversity StudentsWorking Adults

86 משפטים

Chuck Blames Jimmy For Sabotage | Nailed | Better Call Saul

Business EnglishUniversity StudentsWorking Adults

155 משפטים

Inside a scam call center

Business EnglishUniversity StudentsWorking Adults

81 משפטים

Turing & The Halting Problem - Computerphile

Business EnglishUniversity StudentsWorking Adults

101 משפטים

Yes, Prime Minister - The need to know

Business EnglishUniversity StudentsWorking Adults

107 משפטים

Do Phones 'Listen' to Our Conversations? (And How to Stop Them)

Business EnglishUniversity StudentsWorking Adults

363 משפטים

I Go To The Cloud.

Business EnglishUniversity StudentsWorking Adults

738 משפטים

The Closest Thing We Have to Alien Technology

Business EnglishUniversity StudentsWorking Adults

187 משפטים

Watch this before you boot up another device

Business EnglishUniversity StudentsWorking Adults

532 משפטים

your home router STILL SUCKS!! (use OPNsense instead)

Business EnglishUniversity StudentsWorking Adults

77 משפטים

How I Overcame Failure | Jack Ma | 馬雲/马云

Business EnglishUniversity StudentsWorking Adults

אוצר מילים והערות הגייה לשיעור הזה

שיעור הדיבור הזה ברמה C1 מבוסס על הסרטון “Exposing The Flaw In Our Phone System”. בסרטון הזה יש 413 משפטים ו-5072 מילים לתרגול Shadowing. הדיבור נמשך 31:53. הדובר מדבר בקצב טבעי של כ-159 מילים בדקה, קרוב לשיחה יומיומית. רק 80% מהמילים נמצאות בין 3,000 המילים הנפוצות ביותר באנגלית, כך שאוצר המילים מאתגר.

אוצר מילים מרכזי בסרטון הזה

15 המילים המתקדמות ביותר בסרטון, עם ההגייה והמשמעות שלהן:

מילה	הגייה	משמעות
intercept פועל	/ɪntɚˈsɛpt/	יירט
pulse שם עצם	/pʌls/	דֹּפֶק
roam פועל	/ɹoʊm/	שוטט, נדד
hertz שם עצם	/hɝts/	הרץ
subscriber שם עצם	/səbˈskɹaɪbɚ/	מָנוּי
password שם עצם	/ˈpæs.wɜɹd/	סִיסְמָה
volt שם עצם	/vəʊlt/	ווֹלְט
username שם עצם		שם משתמש
yacht שם עצם	/jɑt/	יאכטה
luckily תואר הפועל	/ˈlʌk.ɪ.li/	בכי טוב
voltage שם עצם	/ˈvəʊltɪd͡ʒ/	מֶתַח, ווֹלטָג׳
axis שם עצם	/ˈæksɪs/	ציר
automobile שם עצם	/ˈɔː.tə.məˌbil/	מְכוֹנִית
execute פועל	/ˈɛksɪˌkjuːt/	להוציא להרוג
disk שם עצם	/dɪsk/	דִּיסְק

Phrasal verbs שתשמעו

מילה	הגייה	משמעות
pick up פועל		הרים, אסף
wake up פועל	/ˌweɪk ˈʌp/	התעורר
grow up פועל		גָּדַל
switch off פועל		כיבה

משפטים שכדאי לחזור עליהם

משפטים קצרים ושלמים מהסרטון שאפשר להשתמש בהם בשיחה יומיומית:

You just, it's an app on your computer or what?
How much are we talking?
Do you want to just like try the phone?
Did she hang up on you?
Do you have any important calls coming up?

דקדוק בסרטון הזה

המבנים שהדובר משתמש בהם הכי הרבה, עם המילים המדויקות מהסרטון:

מבנה	בסרטון
“Used to” used to + verb — הרגל או מצב שהיה נכון בעבר וכבר לא קיים	used to be · used to spot
הווה מושלם (Present perfect) have/has + past participle — פעולה שקרתה בעבר ועדיין יש לה חשיבות או השפעה עכשיו	has shifted · they've scaled · we've established
סביל (Passive voice) be + past participle — הדגש הוא על מה שקורה, לא על מי שעושה את הפעולה	was connected · is connected · was increased
משפטי זיקה (Relative clauses) who / which + clause — מידע נוסף על אדם או דבר	zero, which is · people who do · Somebody who grew

הגייה ששווה לשים לב אליה

הדובר משתמש ב-90 קיצורים וצורות מקוצרות, כמו I'm, didn't, don't. אמרו אותם בצורה הקצרה, כפי שאתם שומעים אותם.

הצלילים של “sh” ו-“zh”: authentication /ɔːˌθɛntɪˈkeɪʃn̩/, interception /ɪntɚˈsɛpʃən/, intrusion /ɪnˈtɹuːʒən/
מילים ארוכות — שימו לב להטעמה: vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, authentication /ɔːˌθɛntɪˈkeɪʃn̩/, cybersecurity /saɪbəsɪˈkjʊəɹɪtɪ/, interception /ɪntɚˈsɛpʃən/, automobile /ˈɔː.tə.məˌbil/

צלילים שדוברי עברית מתקשים בהם:

/w/ — שפתיים מעוגלות, לא /v/: password /ˈpæs.wɜɹd/, firewall /ˈfaɪ(ə)ɹˌwɔl/, equip /ɪˈkwɪp/, consequence /ˈkɑn.sɪ.kwəns/
/æ/ — פתוח יותר מה-“אֶ” העברית, לא כמו “a” ב-“cup”: hacker /hækəɹ/, password /ˈpæs.wɜɹd/, axis /ˈæksɪs/
/r/ — הלשון לא נוגעת בשום מקום, לא ה-“ר” הגרונית: roam /ɹoʊm/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, hacker /hækəɹ/, subscriber /səbˈskɹaɪbɚ/, password /ˈpæs.wɜɹd/

איך לתרגל עם הסרטון הזה

הקשיבו לכל הסרטון פעם אחת בלי לדבר, ורשמו את המילים שאתם לא מכירים.
התחילו במהירות 0.75×, תרגלו Shadowing משפט אחר משפט, וחזרו למהירות רגילה כשזה מרגיש קל.
הקליטו את עצמכם והשוו למקור, תוך תשומת לב למילים כמו intercept, pulse, roam.

מהי טכניקת השאדואינג?

שאדואינג היא טכניקת למידת שפה מבוססת מדע שפותחה במקור להכשרת מתורגמנים מקצועיים ופופולרית על ידי הפוליגלוט ד"ר אלכסנדר ארגואלס. השיטה פשוטה אך עוצמתית: אתה מקשיב לאודיו באנגלית ילידית וחוזר עליו בקול רם מיד — כמו צל העוקב אחרי הדובר עם עיכוב של 1–2 שניות בלבד. בניגוד להאזנה פסיבית או תרגילי דקדוק, שאדואינג מכריח את המוח והשרירים בפה לעבד ולשחזר דפוסי דיבור אמיתיים בו זמנית. מחקרים מראים שזה משפר משמעותית את דיוק ההגייה, האינטונציה, הקצב, הדיבור המחובר, הבנת השמיעה ושטף הדיבור — מה שהופך אותו לאחת השיטות היעילות ביותר להכנה לIELTS Speaking ולתקשורת באנגלית בעולם האמיתי.

טכניקת Shadowing: קרא את המדריך המלא שלב אחר שלב →

Shadowing Practice: Exposing The Flaw In Our Phone System - Learn English Speaking with Video

בחר מצב תרגול

הורד אפליקציה

White holes and wormholes are probably real. Here's why.

Something is jamming GPS over Europe. Here's what we found

No device could prove Einstein wrong... until now

Why It Was Almost Impossible to Make the Blue LED

You've (Likely) Been Playing The Game Of Life Wrong

We're trying something new...

How does light 'know' the shortest path?

Why Cold Drinks Were Deadly Before 1914

Our Greatest Delusion

The Most Controversial Problem in Philosophy

We've Been Using The Wrong Science In Court For 50 years

Explaining Pi With Pizza

5 Fun Physics Phenomena

The Absurd Engineering Behind the Internet

The Most Misunderstood Concept in Physics

Falling ladders - why does this happen?

How a slinky falls in slow motion #shorts

We're 99.9% sure this pattern is true, but no one can prove it

What is the secret of a good life? Lessons from the longest study on happiness

How An Infinite Hotel Ran Out Of Room

The most interesting "hack" in history...

Steve Jobs introduces iPhone in 2007

Chuck Blames Jimmy For Sabotage | Nailed | Better Call Saul

Inside a scam call center

Turing & The Halting Problem - Computerphile

Yes, Prime Minister - The need to know

Do Phones 'Listen' to Our Conversations? (And How to Stop Them)

I Go To The Cloud.

The Closest Thing We Have to Alien Technology

Watch this before you boot up another device

your home router STILL SUCKS!! (use OPNsense instead)

How I Overcame Failure | Jack Ma | 馬雲/马云

אוצר מילים והערות הגייה לשיעור הזה

אוצר מילים מרכזי בסרטון הזה

Phrasal verbs שתשמעו

משפטים שכדאי לחזור עליהם

דקדוק בסרטון הזה

הגייה ששווה לשים לב אליה

איך לתרגל עם הסרטון הזה

מהי טכניקת השאדואינג?