シャドーイング練習: Firefox and Tor hit with 9.8 critical level exploit - 動画で英語スピーキングを学ぶ
レッスンを作成中...
1
Last week, we talked about a major exploit discovered in the Chromium-based Arc browser, and all the smart people in the comments were like, thank god I use Firefox.
2
Unfortunately, the turns have tabled, and now another 9.8 critical vulnerability has crashed into a second browser, this time Firefox.
3
And this time, it's been actively exploited in the wild.
4
Now, before you go in the comments and say, thank god I use Tor, it even affects everybody out there doing totally not illegal stuff on the Tor browser, which itself is Firefox-based.
5
This time, though, it wasn't a silly mistake involving a misconfigured Firebase security rule, but rather a used-after-free flaw on their implementation of the CSS animation timeline property.
6
They left a pointer dangling, which is far more difficult to detect and audit, and in this case could be used by bad guys to take full control of your browser with remote code execution.
7
If you're running one of these Firefox versions, you're probably already dead, but if not, you'll want to update immediately.
8
In today's video, you'll learn all about the interesting and terrifying world of use-after-free exploits.
9
It is October 15th, 2024, and you're watching the Code Report.
10
Before we get started, though, I have some other bad news for internet browser users, specifically those on Chrome using uBlock Origin, or any other ad blocker for that matter.
11
We all knew this day was coming, but shots were fired yesterday when this ominous message appeared on the plugin's install page, warning users that uBlock's execution date is drawing near.
12
Now, this is all part of a grand conspiracy to get you to watch ads and be happy, and Google is achieving that by updating the manifest for plugins from version 2 to version 3,
13
which eliminates the web request API where plugins can see all the incoming network requests
14
so they can block all the garbage from known ad servers.
15
I made a video on this a while ago if you want all the details, but now let's get back to Firefox.
16
Slovakian company ESET has been credited with discovering and reporting the vulnerability.
17
Where an attacker is able to achieve code execution by exploiting a use after free flaw in the CSS animation timeline.
18
I use the animation timeline all the time to create scroll animations on websites that nobody asked for, and never would have expected it to be an attack vector.
19
But to understand why this is so bad, we need to understand what use after free actually means.
20
Exploits like this have affected all the other browsers, including Chrome and Safari, and useAfterFree was even responsible for the iOS jailbreak of 2019.
21
The Firefox browser is free and open source, but you won't find it on GitHub.
22
Its code is actually self-hosted and uses Mercurial for version control.
23
It's primarily written in C++, although more and more of its code is now being written in Rust, a language that was created by a software engineer at Mozilla.
24
Firefox itself contains over 30 million lines of code, because building a browser is extremely complex.
25
At a high level, here's how a use-after-free flaw could be introduced.
26
In the C code, let's imagine we need to allocate some memory for a value.
27
To achieve that, we create a pointer and then use malloc to allocate memory for it.
28
From there we can assign a value to it and use it in our program to do something useful, like in the case of Firefox, render an animation.
29
At some later point, when we no longer need that memory, we'll want to deallocate it with free.
30
But now we have a problem called a dangling pointer.
31
The memory is free, but the pointer itself still exists and is now being used in our code with undefined behavior.
32
If an attacker can figure out how to get some malicious code into that memory, it can cause the program to crash, or even worse, remote code execution.
33
Now, this could be easily fixed by setting the pointer to null or a different object, but in the case of Firefox, the issue is likely a lot more complex and above my pay grade.
34
It's still being analyzed, so there's not a ton of detail, but Mozilla stated that they have had reports of the vulnerability being exploited in the wild.
35
The good news, though, is that it's completely fixed, and it doesn't appear anything catastrophic has happened.
36
In addition, if you're using the anonymous Tor browser, an attacker could take control of your browser, but probably not totally de-anonymize you, assuming you're on Tails OS,
37
which recently merged with the Tor browser as one project.
38
Now, another browser that was affected by all this is Zen, which is an awesome open source project based on Firefox.
39
They quickly update it to the fixed version, but it just goes to show how one little flaw can affect a lot of downstream projects.
40
But if your goal is to write robust, bulletproof code, you'll need to start with computer science fundamentals.
41
And you can start doing that today for free thanks to this video's sponsor, Brilliant.
42
Their quick, rewarding, interactive lessons will help you build a foundation for problem solving that every software engineer needs to have.
43
Brilliant is where you learn by doing, with thousands of interactive lessons in math, data analysis, programming, and AI.
44
When you make their Python course a habit with just a few minutes of effort each day, you'll quickly develop the skills needed to build world-changing software.
45
And you can do it anywhere, even from your phone.
46
To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash fireship or scan this QR code for 20% off their premium annual subscription.
47
This has been the Code Report, thanks for watching, and I will see you in the next one.
📺 同じチャンネル
B22
A $6.3 billion open-weight model just got embarrassed by the French...
C11
PostgreSQL in 100 Seconds
C12
DNS Explained in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B23
Anthropic begged the world to stop AI… then shipped this
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
One man just liberated Fable... and now it’s illegal
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
7 Things No Programmer Ever Wants to Hear
American AccentBusiness EnglishWorking Adults
B21
80% of programmers are NOT happy… why?
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
Raspberry Pi Explained in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C13
Tragic mistake... Anthropic leaks Claude’s source code
American AccentBusiness EnglishUniversity StudentsWorking Adults
C1100+ Docker Concepts you Need to Know
American AccentBusiness EnglishUniversity StudentsWorking Adults
C129
Docker in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
C13
The mystery is solved... and the answer is 40x cheaper than Claude
American AccentBusiness EnglishUniversity StudentsWorking Adults
B28
An ex-OpenAI researcher just deleted language from the LLM...
American AccentBusiness EnglishUniversity StudentsWorking Adults
B29
25 crazy software bugs explained
American AccentBusiness EnglishUniversity StudentsWorking Adults
B29
Git Explained in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
B25
There's a new Linux distro in town for developers...
American AccentBusiness EnglishUniversity StudentsWorking Adults
B25
The "vibe coding" mind virus explained…
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
Linux got wrecked by backdoor attack
American AccentBusiness EnglishUniversity StudentsWorking Adults
B24
7 Programming myths that waste your time
American AccentBusiness EnglishUniversity StudentsWorking Adults
C115
Nvidia CUDA in 100 Seconds
American AccentBusiness EnglishUniversity StudentsWorking Adults
✨ おすすめ動画
B23
46 文
OpenAI’s new browser feels familiar…
American AccentBusiness EnglishUniversity StudentsWorking Adults
B22
364 文
I Outsmarted Pro Car Thieves
American AccentBusiness EnglishUniversity StudentsWorking Adults
B21
296 文
Windows Update Shouldn’t Be Allowed to Do This
Business EnglishUniversity StudentsWorking Adults
B22
142 文
The Internet Didn't Fail. It Was Taken.
American AccentBusiness EnglishDaily ConversationUniversity Students
B211
26 文
Two Developers Before a Release: The Login Bug Is Back
American AccentBusiness EnglishDaily ConversationWorking Adults
B23
151 文
How Ad Blockers Work
Business EnglishUniversity StudentsWorking Adults
C13
173 文
STOP Running Code On Your Computer
Business EnglishUniversity StudentsWorking Adults
B21
364 文
World's Deadliest Computer Virus: WannaCry
Business EnglishUniversity StudentsWorking Adults
B21
131 文
The Worst Sponsorships in YouTube History
Business EnglishUniversity StudentsWorking Adults
B22
185 文
Use these CSS features instead of JavaScript
Business EnglishUniversity StudentsWorking Adults
B21
283 文
The Gaming Market is Starting to Break.
British AccentBusiness EnglishUniversity StudentsWorking Adults
このレッスンの語彙とスピーキングのポイント
このB2レベルのスピーキングレッスンは、動画「Firefox and Tor hit with 9.8 critical level exploit」を教材にしています。 繰り返し出てくる語は次のとおりです：code, browser, Firefox, pointer, animation。 この動画には、シャドーイング用の文が47文、単語が991語あります。 音声の長さは4:27です。 話す速さは速く、1分あたり約223語です。音のつながりや弱く発音される音が多くなります。 英語の頻出3,000語に含まれる単語は80%だけなので、語彙は難しめです。
この動画の重要語彙
動画の中で特に難しい単語15語を、発音と意味つきで紹介します。
| 単語 | 発音 | 意味 |
|---|---|---|
| exploit 名詞 | /ˈɛksplɔɪt/ | 偉業 |
| pointer 名詞 | /ˈpɔɪn.təɹ/ | 指し棒 |
| animation 名詞 | /ˌæn.ɪˈmeɪ.ʃən/ | アニメーション, アニメ |
| flaw 名詞 | /flɔ/ | ひび |
| vulnerability 名詞 | /ˌvʌln(ə)ɹəˈbɪlɪti/ | 脆弱性 |
| timeline 名詞 | /ˈtaɪmˌlaɪn/ | 年表, 年譜 |
| allocate 動詞 | /ˈæl.ə.keɪt/ | 取り置く |
| bulletproof 形容詞 | /ˈbʊlɪtpɹuf/ | 防弾 |
| jailbreak 名詞 | /ˈd͡ʒeɪlˌbɹeɪk/ | 脱獄 |
| ominous 形容詞 | /ˈɑmɪnəs/ | 不吉 |
| downstream 形容詞 | /ˌdaʊnˈstɹiːm/ | 下流 |
| assign 動詞 | /əˈsaɪn/ | 割り当てる |
| malicious 形容詞 | /məˈlɪʃəs/ | 悪意のある |
| manifest 名詞 | /ˈmæn.ɪ.fɛst/ | 積荷目録 |
| null 名詞 | /nʌl/ | 無, 無価値 |
この動画の文法
話し手がよく使っている文型を、動画の実際の表現とともに紹介します。
| 文型 | 動画での表現 |
|---|---|
| 受動態 be + 過去分詞 — 誰がするかより、何が起きるかに焦点を当てる | were fired · has been credited · being written |
| 現在完了形 have/has + 過去分詞 — 過去の出来事が今も関係している | have tabled · has been credited · have affected |
| 関係詞節 who / which + 節 — 人や物について情報を加える | dangling, which is · Zen, which is |
注意したい発音
話し手はyou're, you'll, doesn'tなど、短縮形や弱形を13回使っています。聞こえたとおりの短い形で発音しましょう。
- 「sh」と「zh」の音: animation /ˌæn.ɪˈmeɪ.ʃən/, malicious /məˈlɪʃəs/, subscription /səbˈskɹɪpʃən/
- 長い単語（アクセントの位置に注意）: animation /ˌæn.ɪˈmeɪ.ʃən/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, interactive /ˌɪn.tɚˈæk.tɪv/, deallocate /diːˈæləkeɪt/, catastrophic /ˌkætəˈstɹɑfɪk/
日本語話者が苦手な音：
- /r/ と /l/ の区別 — /l/ は舌先を歯茎につけ、/r/ はどこにもつけない: vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, bulletproof /ˈbʊlɪtpɹuf/, jailbreak /ˈd͡ʒeɪlˌbɹeɪk/, scroll /skɹoʊl/
- /v/ — /b/ にならないように、上の歯を下唇に当てる: vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, interactive /ˌɪn.tɚˈæk.tɪv/, vector /ˈvɛktɚ/
- /f/ — 「フ」ではなく、上の歯と下唇で出す: flaw /flɔ/, bulletproof /ˈbʊlɪtpɹuf/, terrify /ˈtɛɹɪfaɪ/, catastrophic /ˌkætəˈstɹɑfɪk/, manifest /ˈmæn.ɪ.fɛst/
この動画での練習方法
- まず声を出さずに動画を最後まで聞き、知らない単語をメモします。
- まず0.75倍速で一文ずつシャドーイングし、慣れてきたら通常の速度に戻します。
- 自分の声を録音して元の音声と比べます。exploit, pointer, animationなどの単語に特に注意しましょう。
シャドーイングとは？英語上達に効果的な理由
シャドーイング（Shadowing）は、もともとプロの通訳者養成プログラムで開発された言語学習法で、多言語習得者として知られるDr. Alexander Arguelles によって広く普及されました。方法はシンプルですが非常に効果的：ネイティブスピーカーの英語を聞きながら、1〜2秒の遅延で声に出してすぐに繰り返す——まるで「影（shadow）」のように話者を追いかけます。文法ドリルや受動的なリスニングと異なり、シャドーイングは脳と口の筋肉が同時にリアルタイムで英語を処理・再現することを強制します。研究により、発音精度、抑揚、リズム、連音、リスニング力、そして会話の流暢さが大幅に向上することが確認されています。IELTSスピーキング対策や自然な英語コミュニケーションを目指す方に特におすすめです。