シャドーイング練習: Linux got wrecked by backdoor attack - 動画で英語スピーキングを学ぶ

練習モードを選ぶ

各モードは全画面の練習ルームで開きます。

51 文

文が短すぎたり長すぎる場合は、Editをタップして調整してください。

Over the last few days, the open -source world has been in panic mode.

A highly sophisticated and carefully planned attack affecting the XZ compression tool was shipped to production,

and has compromised Linux distros like Debian, Kali, OpenSUSE, and others.

Thank God, TempleOS is unaffected though, and it's quite possibly one of the most well -executed supply chain attacks of all time,

and gives some random dude unfettered access to execute code on your machine via a secret backdoor.

This is not your everyday security vulnerability.

It's a threat -level midnight 10 .0 critical issue on the CVE Richter scale, even higher than famous bugs like Heartbleed, Log4Shell, and Shellshock.

In today's video, you'll learn exactly how the XZ backdoor works, and the incredible story of how it was discovered by accident.

It is April 1st, 2024, and you're watching the Code Report.

Unfortunately, this is not an April Fool's video.

If you happen to be using one of the Linux distros listed here, you'll want to upgrade immediately.

Luckily, it only affects a very narrow set of distros, most of which are unstable builds, but that's only because this backdoor was discovered by pure luck early on.

More on that in just a second, let's first take a deep dive into this backdoor.

XZ -Utils is a tool for compressing and decompressing streams based on the Lempel -Ziv Markov Chain Algorithm, or LZMA.

It contains a command line tool that's installed on most Linux distros by default, which you can use right now with the XZ command, but also contains an API library called lib -LZMA,

and many other pieces of software depend on this library to implement compression, One of which is SSHD, or Secure Shell Daemon, a tool that listens to SSH connections,

like when you connect your local machine to the terminal on a cloud server.

Now here's where the backdoor comes in, but keep in mind, researchers are still figuring out exactly how this thing works.

Malicious code was discovered in the tarballs of LibLZMA, which is the thing that most people actually install.

That malicious code is not present in the source code, though.

It uses a series of obfuscations to hide the malicious code, then at build time, it injects a pre -built object disguised as a test file that lives in the source code.

It modifies specific parts of the LZMA code, which ultimately allows the attacker to intercept and modify data that interacts with this library.

Researchers have also discovered that any payload sent to the backdoor must be signed by the attacker's private key.

In other words, the attacker is the only one who can send a payload to the backdoor, making it more difficult to test and monitor.

And the attacker went to great lengths to obfuscate the code, like it contains no ASCII characters and instead has a built -in state machine to recognize important strings.

Now, because the vast majority of servers that power the internet are Linux -based, this backdoor could have been a major disaster.

Luckily, though, a hero software engineer named Andres Freund was using the unstable branch of Debian to benchmark Postgres.

He noticed something weird that most people would overlook.

SSH logins were using up more CPU resources than normal.

Initially, he thought it was an issue in Debian directly, but after some investigation, discovered it was actually upstream in exeutils.

And that's really bad, because so many things depend on this tool.

In German, his last name translates to friend, which is fitting, because he single -handedly helped the world avoid a multi -billion dollar disaster. But whodunit?

Who's the bad guy here?

At this point, it's unclear.

The LibLZMA project is maintained by Lassie Collin.

However, the malicious tarballs are signed by Gia Tan, a contributor to the project.

This individual has been a trusted contributor for the last few years, but clearly, they've been playing the long game.

They spent years building up trust before trying the backdoor, and nobody even noticed when they made their move.

I say they because we don't know if this is an individual or a penetration attempt from a rogue state like Russia, North Korea, or the United States.

Here's a non -technical analogy.

Imagine there's a landlord, we'll call him Lassie Collin, who manages a popular apartment building.

It's a lot of work, but this young, enthusiastic guy has been super helpful over the last couple years, adding all sorts of upgrades and renovations.

Let's call him Gia Tan.

He does great work, but he's also been secretly installing cameras in the bathrooms, which only he can access from the internet with his password.

Now, he would have gotten away with it too if it weren't for a pesky tenant named Andres, who happened to notice that his electricity bill was just a little bit higher than usual.

He started looking behind the walls and found some unexpected wires that led right to the unauthorized cameras.

At this point, we don't know the true identity of the hacker, but whoever did this was looking to cast a very wide net, and because it's protected by a secret key, can only be exploited by one party.

XZ was a sitting duck because it's extremely popular, while also being very boring with a single maintainer.

Whoever's behind this is either an extremely intelligent psychopath, or more likely, a group of state -sponsored dimension -hopping lizard people hellbent on world domination.

And that's why the only distro you should use is TempleOS.

This has been The Code Report, thanks for watching, and I will see you in the next one.

アプリをダウンロード

流暢に話すために必要なすべて

AI発音採点文ごとに採点

IPA練習すべての音をマスター

単語学習自分の単語帳を作る

単語ゲーム遊びながら覚える

QRをスキャン

Download on theApp Store Get it onGoogle Play

同じチャンネル

FOR YOU

このレッスンの語彙とスピーキングのポイント

この動画には、シャドーイング用の文が51文、単語が944語あります。音声の長さは4:32です。話す速さは速く、1分あたり約209語です。音のつながりや弱く発音される音が多くなります。英語の頻出3,000語に含まれる単語は76%だけなので、語彙は難しめです。

この動画の重要語彙

動画に出てくるやや難しい単語15語を、発音と意味つきで紹介します。

discover /dɪˈskʌvə/ (動詞) — 発見する, 見つける. To find or learn something for the first time.
malicious /məˈlɪʃəs/ (形容詞) — 悪意のある. Intending to do harm; characterized by spite and malice.
server /ˈsɝvɚ/ (名詞) — サーバー. A program that provides services to other programs or devices, either in the same computer or over a computer network.
disaster /dɪˈzɑːs.təː/ (名詞) — 災害, 天災. An unexpected natural or man-made catastrophe of substantial extent causing significant physical damage or destruction, loss of life or sometimes permanent…
depend /dɪˈpɛnd/ (動詞) — 依存する. To be contingent or conditioned; to have something as a necessary condition
install /ɪnˈstɔl/ (動詞) — 導入する, インストールする. To connect, set up or prepare something for use
execute /ˈɛksɪˌkjuːt/ (動詞) — 処刑する, 消す. To kill, especially as punishment for a capital crime.
luckily /ˈlʌk.ɪ.li/ (副詞) — 幸いにも, 運良く. In a lucky manner; by good fortune; fortunately.
researcher /ˈɹiˌsɝ.t͡ʃɚ/ (名詞) — 研究員, 研究者. One who researches.
unstable /ʌnˈsteɪ.bəl/ (形容詞) — 不安定. Not stable.
vast /væst/ (形容詞) — 広大な, 莫大な. Very large or wide (literally or figuratively).
carefully /ˈkɛɹf(ə)li/ (副詞) — じっくり, 慎重に. With care; attentively, circumspectly.
cloud /ˈklaʊ̯d/ (名詞) — 雲, 雲霞. A visible mass of water droplets suspended in the air.
helpful /ˈhɛlp.fl̩/ (形容詞) — 役に立つ, 有用. Furnishing help; giving aid; useful.
wire /ˈwaɪɚ/ (名詞) — 針金, 線. Metal formed into a thin, even thread, now usually by being drawn through a hole in a steel die.

注意したい発音

話し手はdon't, you'll, they'veなど、短縮形や弱形を8回使っています。聞こえたとおりの短い形で発音しましょう。

「th」の音: enthusiastic /ɪnˌθjuːzɪˈæstɪk/, psychopath /ˈsaɪkəʊpæθ/
「sh」と「zh」の音: malicious /məˈlɪʃəs/, compression /kəmˈpɹɛʃ.ən/, dimension /daɪˈmɛn.ʃən/, renovation /ɹɛnəˈveɪʃən/, penetration /pɛ.nəˈtɹeɪ.ʃən/
長い単語（アクセントの位置に注意）: contributor /kənˈtɹɪb.jə.tɚ/, electricity /ɪˌlɛkˈtɹɪsɪti/, intelligent /ɪnˈtɛlɪd͡ʒənt/, unexpected /ʌnɪkˈspɛktɪd/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/

この動画での練習方法

まず声を出さずに動画を最後まで聞き、知らない単語をメモします。
まず0.75倍速で一文ずつシャドーイングし、慣れてきたら通常の速度に戻します。
自分の声を録音して元の音声と比べます。discover, malicious, serverなどの単語に特に注意しましょう。

この動画の文法

話し手がよく使っている文型を、動画の実際の表現とともに紹介します。

文型	動画での表現
受動態 be + 過去分詞 — 誰がするかより、何が起きるかに焦点を当てる	was shipped · is unaffected · was discovered
現在完了形 have/has + 過去分詞 — 過去の出来事が今も関係している	has been · has compromised · have also discovered
関係詞節 who / which + 節 — 人や物について情報を加える	LibLZMA, which is · one who can · friend, which is

シャドーイングとは？英語上達に効果的な理由

シャドーイング（Shadowing）は、もともとプロの通訳者養成プログラムで開発された言語学習法で、多言語習得者として知られるDr. Alexander Arguelles によって広く普及されました。方法はシンプルですが非常に効果的：ネイティブスピーカーの英語を聞きながら、1〜2秒の遅延で声に出してすぐに繰り返す——まるで「影（shadow）」のように話者を追いかけます。文法ドリルや受動的なリスニングと異なり、シャドーイングは脳と口の筋肉が同時にリアルタイムで英語を処理・再現することを強制します。研究により、発音精度、抑揚、リズム、連音、リスニング力、そして会話の流暢さが大幅に向上することが確認されています。IELTSスピーキング対策や自然な英語コミュニケーションを目指す方に特におすすめです。

シャドーイングのやり方: ステップ別の完全ガイドを読む →

シャドーイング練習: Linux got wrecked by backdoor attack - 動画で英語スピーキングを学ぶ

練習モードを選ぶ

アプリをダウンロード

PostgreSQL in 100 Seconds

React Native in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Brainf**k in 100 Seconds

Mind-bending new programming language for GPUs just dropped...

The plan to break apart Google... RIP Chrome

Docker in 100 Seconds

The worst week in cybersecurity history... so far

The last real programmers are dying out...

Did the AI bubble just pop?

When open-sourcing your code goes wrong...

OpenAI’s new browser feels familiar…

The most interesting "hack" in history...

Tragic mistake... Anthropic leaks Claude’s source code

Firefox and Tor hit with 9.8 critical level exploit

C++ in 100 Seconds

China just dropped a new frontier model... and nobody can explain how

Linux in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

VS Code in 100 Seconds

There's a new Linux distro in town for developers...

you need to learn HACKING RIGHT NOW!! // CEH (ethical hacking)

So I tried Matt's skills...

STOP Running Code On Your Computer

THIS Is Where the Internet Lives

Did Anthropic Kill Git?

Cicada 3301: An Internet Mystery

Debian Linux GNU Coreutils Situation Is Crazy

Running AI Agents in Secure Sandboxes with E2B & Docker MCP | Docker’s AI Guide to the Galaxy

I Tested The Viral Reverse Engineering Repo

Helpdesk to Sysadmin - 3 Things You Must Learn First