Shadowing Practice: Linux got wrecked by backdoor attack - Learn English Speaking with Video
בחר מצב תרגול
כל מצב פותח חדר תרגול במסך מלא.
51 משפטים
אם המשפטים קצרים או ארוכים מדי, לחץ על ערוך כדי להתאים אותם.
1
Over the last few days, the open -source world has been in panic mode.
2
A highly sophisticated and carefully planned attack affecting the XZ compression tool was shipped to production,
3
and has compromised Linux distros like Debian, Kali, OpenSUSE, and others.
4
Thank God, TempleOS is unaffected though, and it's quite possibly one of the most well -executed supply chain attacks of all time,
5
and gives some random dude unfettered access to execute code on your machine via a secret backdoor.
6
This is not your everyday security vulnerability.
7
It's a threat -level midnight 10 .0 critical issue on the CVE Richter scale, even higher than famous bugs like Heartbleed, Log4Shell, and Shellshock.
8
In today's video, you'll learn exactly how the XZ backdoor works, and the incredible story of how it was discovered by accident.
9
It is April 1st, 2024, and you're watching the Code Report.
10
Unfortunately, this is not an April Fool's video.
11
If you happen to be using one of the Linux distros listed here, you'll want to upgrade immediately.
12
Luckily, it only affects a very narrow set of distros, most of which are unstable builds, but that's only because this backdoor was discovered by pure luck early on.
13
More on that in just a second, let's first take a deep dive into this backdoor.
14
XZ -Utils is a tool for compressing and decompressing streams based on the Lempel -Ziv Markov Chain Algorithm, or LZMA.
15
It contains a command line tool that's installed on most Linux distros by default, which you can use right now with the XZ command, but also contains an API library called lib -LZMA,
16
and many other pieces of software depend on this library to implement compression, One of which is SSHD, or Secure Shell Daemon, a tool that listens to SSH connections,
17
like when you connect your local machine to the terminal on a cloud server.
18
Now here's where the backdoor comes in, but keep in mind, researchers are still figuring out exactly how this thing works.
19
Malicious code was discovered in the tarballs of LibLZMA, which is the thing that most people actually install.
20
That malicious code is not present in the source code, though.
21
It uses a series of obfuscations to hide the malicious code, then at build time, it injects a pre -built object disguised as a test file that lives in the source code.
22
It modifies specific parts of the LZMA code, which ultimately allows the attacker to intercept and modify data that interacts with this library.
23
Researchers have also discovered that any payload sent to the backdoor must be signed by the attacker's private key.
24
In other words, the attacker is the only one who can send a payload to the backdoor, making it more difficult to test and monitor.
25
And the attacker went to great lengths to obfuscate the code, like it contains no ASCII characters and instead has a built -in state machine to recognize important strings.
26
Now, because the vast majority of servers that power the internet are Linux -based, this backdoor could have been a major disaster.
27
Luckily, though, a hero software engineer named Andres Freund was using the unstable branch of Debian to benchmark Postgres.
28
He noticed something weird that most people would overlook.
29
SSH logins were using up more CPU resources than normal.
30
Initially, he thought it was an issue in Debian directly, but after some investigation, discovered it was actually upstream in exeutils.
31
And that's really bad, because so many things depend on this tool.
32
In German, his last name translates to friend, which is fitting, because he single -handedly helped the world avoid a multi -billion dollar disaster. But whodunit?
33
Who's the bad guy here?
34
At this point, it's unclear.
35
The LibLZMA project is maintained by Lassie Collin.
36
However, the malicious tarballs are signed by Gia Tan, a contributor to the project.
37
This individual has been a trusted contributor for the last few years, but clearly, they've been playing the long game.
38
They spent years building up trust before trying the backdoor, and nobody even noticed when they made their move.
39
I say they because we don't know if this is an individual or a penetration attempt from a rogue state like Russia, North Korea, or the United States.
40
Here's a non -technical analogy.
41
Imagine there's a landlord, we'll call him Lassie Collin, who manages a popular apartment building.
42
It's a lot of work, but this young, enthusiastic guy has been super helpful over the last couple years, adding all sorts of upgrades and renovations.
43
Let's call him Gia Tan.
44
He does great work, but he's also been secretly installing cameras in the bathrooms, which only he can access from the internet with his password.
45
Now, he would have gotten away with it too if it weren't for a pesky tenant named Andres, who happened to notice that his electricity bill was just a little bit higher than usual.
46
He started looking behind the walls and found some unexpected wires that led right to the unauthorized cameras.
47
At this point, we don't know the true identity of the hacker, but whoever did this was looking to cast a very wide net, and because it's protected by a secret key, can only be exploited by one party.
48
XZ was a sitting duck because it's extremely popular, while also being very boring with a single maintainer.
49
Whoever's behind this is either an extremely intelligent psychopath, or more likely, a group of state -sponsored dimension -hopping lizard people hellbent on world domination.
50
And that's why the only distro you should use is TempleOS.
51
This has been The Code Report, thanks for watching, and I will see you in the next one.
הורד אפליקציה
כל מה שאתה צריך כדי לדבר בשטף
הגיית AIציון לכל משפט
תרגול IPAשלוט בכל צליל
אוצר מיליםבנה את מאגר המילים שלך
משחק אוצר מיליםלמד תוך כדי משחק
אותו ערוץ
C11
PostgreSQL in 100 Seconds
Daily ConversationWorking Adults
C11
React Native in 100 Seconds
Daily ConversationUniversity Students
C12
Did Google just dethrone OpenAI and Anthropic?
Daily ConversationUniversity StudentsWorking Adults
C13
Every app on Earth is now open source... whether it likes it or not
Daily ConversationWorking Adults
C14
Brainf**k in 100 Seconds
Daily ConversationUniversity Students
C13
OpenAI’s lead engineer was secretly a spy...
Daily ConversationUniversity StudentsWorking Adults
C19
The most interesting "hack" in history...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
Mind-bending new programming language for GPUs just dropped...
Daily ConversationUniversity Students
C12
China just dropped a new frontier model... and nobody can explain how
Daily ConversationUniversity StudentsWorking Adults
C12
The last real programmers are dying out...
Daily ConversationUniversity StudentsWorking Adults
C11
Did the AI bubble just pop?
Daily ConversationUniversity StudentsWorking Adults
B26
Intel chips can’t possibly be this bad… 100% crash rate?
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
OpenAI’s new browser feels familiar…
American AccentBusiness EnglishUniversity StudentsWorking Adults
C130
Docker in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
Firefox and Tor hit with 9.8 critical level exploit
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
5 open source tools that replaced my $320/mo AI stack...
American AccentBusiness EnglishUniversity StudentsWorking Adults
C12
C++ in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
Linux in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
Meta is pivoting again... everything you missed from Connect 2026
American AccentBusiness EnglishUniversity StudentsWorking Adults
C116
VS Code in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
FOR YOU
המלץ על סרטון
C15
59 משפטים
There's a new Linux distro in town for developers...
American AccentDaily ConversationUniversity StudentsWorking Adults
C13
173 משפטים
STOP Running Code On Your Computer
Daily ConversationUniversity StudentsWorking Adults
C12
102 משפטים
What is Docker? Docker container concept explained || Docker Tutorial 1
Daily ConversationUniversity StudentsWorking Adults
C12
215 משפטים
Debian Linux GNU Coreutils Situation Is Crazy
Daily ConversationWorking Adults
C11
65 משפטים
Did Anthropic Kill Git?
Daily ConversationUniversity StudentsWorking Adults
C11
207 משפטים
Go’s Big Mistake
Daily ConversationUniversity StudentsWorking Adults
C11
137 משפטים
JUST $1 For Billions of Tokens?! (DeepSeek v4 Pro)
Daily ConversationUniversity StudentsWorking Adults
C11
54 משפטים
Traceroute: You're Probably Reading the Results Wrong
Daily ConversationUniversity StudentsWorking Adults
C12
169 משפטים
12 Things That Could Destroy Earth
Daily ConversationUniversity StudentsWorking Adults
C11
179 משפטים
Cicada 3301: An Internet Mystery
Daily ConversationUniversity StudentsWorking Adults
C11
78 משפטים
How I deploy serverless containers for free
Daily ConversationUniversity StudentsWorking Adults
אוצר מילים והערות הגייה לשיעור הזה
שיעור הדיבור הזה ברמה C1 מבוסס על הסרטון “Linux got wrecked by backdoor attack”. המילים שחוזרות הכי הרבה: code, backdoor, distro, tool, discovered. בסרטון הזה יש 51 משפטים ו-944 מילים לתרגול Shadowing. הדיבור נמשך 4:32. הדובר מדבר מהר, כ-209 מילים בדקה, אז צפו לצלילים מחוברים ומקוצרים. רק 76% מהמילים נמצאות בין 3,000 המילים הנפוצות ביותר באנגלית, כך שאוצר המילים מאתגר.
אוצר מילים מרכזי בסרטון הזה
13 המילים המתקדמות ביותר בסרטון, עם ההגייה והמשמעות שלהן:
| מילה | הגייה | משמעות |
|---|---|---|
| contributor שם עצם | /kənˈtɹɪb.jə.tɚ/ | תורם, תורמת |
| luckily תואר הפועל | /ˈlʌk.ɪ.li/ | בכי טוב |
| execute פועל | /ˈɛksɪˌkjuːt/ | להוציא להרוג |
| obfuscate פועל | /ˈɑbfəskeɪt/ | החשיך |
| psychopath שם עצם | /ˈsaɪkəʊpæθ/ | פְּסִיכוֹפָּת |
| intercept פועל | /ɪntɚˈsɛpt/ | יירט |
| lizard שם עצם | /ˈlɪzɚd/ | לְטָאָה, חַרְדּוֹן |
| disguise פועל | /dɪsˈɡaɪz/ | הסווה |
| renovation שם עצם | /ɹɛnəˈveɪʃən/ | שיפוץ, שִׁפּוּץ |
| translate פועל | /tɹænzˈleɪt/ | תִּרְגֵּם |
| bore פועל | /boɹ/ | שִׁעֲמֵם |
| dimension שם עצם | /daɪˈmɛn.ʃən/ | מֵמַד |
| password שם עצם | /ˈpæs.wɜɹd/ | סִיסְמָה |
Phrasal verbs שתשמעו
| מילה | משמעות |
|---|---|
| figure out פועל | הֵבִין, מצא תשובה |
דקדוק בסרטון הזה
המבנים שהדובר משתמש בהם הכי הרבה, עם המילים המדויקות מהסרטון:
| מבנה | בסרטון |
|---|---|
| סביל (Passive voice) be + past participle — הדגש הוא על מה שקורה, לא על מי שעושה את הפעולה | was shipped · is unaffected · was discovered |
| הווה מושלם (Present perfect) have/has + past participle — פעולה שקרתה בעבר ועדיין יש לה חשיבות או השפעה עכשיו | has been · has compromised · have also discovered |
| משפטי זיקה (Relative clauses) who / which + clause — מידע נוסף על אדם או דבר | LibLZMA, which is · one who can · friend, which is |
הגייה ששווה לשים לב אליה
הדובר משתמש ב-8 קיצורים וצורות מקוצרות, כמו don't, you'll, they've. אמרו אותם בצורה הקצרה, כפי שאתם שומעים אותם.
- הצלילים של “th”: psychopath /ˈsaɪkəʊpæθ/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/
- הצלילים של “sh” ו-“zh”: malicious /məˈlɪʃəs/, compression /kəmˈpɹɛʃ.ən/, obfuscation /ˌɑb.fəˈskeɪ.ʃən/, benchmark /ˈbɛn(t)ʃmɑːk/, domination /ˌdɑːməˈneɪʃən/
- מילים ארוכות — שימו לב להטעמה: contributor /kənˈtɹɪb.jə.tɚ/, obfuscation /ˌɑb.fəˈskeɪ.ʃən/, unaffected /ˌʌnəˈfɛktɪd/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, domination /ˌdɑːməˈneɪʃən/
צלילים שדוברי עברית מתקשים בהם:
- /æ/ — פתוח יותר מה-“אֶ” העברית, לא כמו “a” ב-“cup”: attacker /əˈtækɚ/, psychopath /ˈsaɪkəʊpæθ/, hacker /hækəɹ/, analogy /əˈnæləd͡ʒi/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/
- /r/ — הלשון לא נוגעת בשום מקום, לא ה-“ר” הגרונית: distro /ˈdɪstɹoʊ/, contributor /kənˈtɹɪb.jə.tɚ/, compression /kəmˈpɹɛʃ.ən/, researcher /ˈɹiˌsɝ.t͡ʃɚ/, compress /ˈkɑmpɹɛs/
- עיצור קולי בסוף מילה — /b/, /d/, /g/, /z/, /v/ בלי להפוך אותם לאטומים: payload /ˈpeɪloʊd/, unaffected /ˌʌnəˈfɛktɪd/, unfettered /ˈʌnˈfɛtɚd/, lizard /ˈlɪzɚd/, disguise /dɪsˈɡaɪz/
איך לתרגל עם הסרטון הזה
- הקשיבו לכל הסרטון פעם אחת בלי לדבר, ורשמו את המילים שאתם לא מכירים.
- התחילו במהירות 0.75×, תרגלו Shadowing משפט אחר משפט, וחזרו למהירות רגילה כשזה מרגיש קל.
- הקליטו את עצמכם והשוו למקור, תוך תשומת לב למילים כמו contributor, luckily, execute.
מהי טכניקת השאדואינג?
שאדואינג היא טכניקת למידת שפה מבוססת מדע שפותחה במקור להכשרת מתורגמנים מקצועיים ופופולרית על ידי הפוליגלוט ד"ר אלכסנדר ארגואלס. השיטה פשוטה אך עוצמתית: אתה מקשיב לאודיו באנגלית ילידית וחוזר עליו בקול רם מיד — כמו צל העוקב אחרי הדובר עם עיכוב של 1–2 שניות בלבד. בניגוד להאזנה פסיבית או תרגילי דקדוק, שאדואינג מכריח את המוח והשרירים בפה לעבד ולשחזר דפוסי דיבור אמיתיים בו זמנית. מחקרים מראים שזה משפר משמעותית את דיוק ההגייה, האינטונציה, הקצב, הדיבור המחובר, הבנת השמיעה ושטף הדיבור — מה שהופך אותו לאחת השיטות היעילות ביותר להכנה לIELTS Speaking ולתקשורת באנגלית בעולם האמיתי.