쉐도잉 연습: Firefox and Tor hit with 9.8 critical level exploit - 영상으로 영어 말하기 배우기

Last week, we talked about a major exploit discovered in the Chromium-based Arc browser, and all the smart people in the comments were like, thank god I use Firefox.

Unfortunately, the turns have tabled, and now another 9.8 critical vulnerability has crashed into a second browser, this time Firefox.

And this time, it's been actively exploited in the wild.

Now, before you go in the comments and say, thank god I use Tor, it even affects everybody out there doing totally not illegal stuff on the Tor browser, which itself is Firefox-based.

This time, though, it wasn't a silly mistake involving a misconfigured Firebase security rule, but rather a used-after-free flaw on their implementation of the CSS animation timeline property.

They left a pointer dangling, which is far more difficult to detect and audit, and in this case could be used by bad guys to take full control of your browser with remote code execution.

If you're running one of these Firefox versions, you're probably already dead, but if not, you'll want to update immediately.

In today's video, you'll learn all about the interesting and terrifying world of use-after-free exploits.

It is October 15th, 2024, and you're watching the Code Report.

Before we get started, though, I have some other bad news for internet browser users, specifically those on Chrome using uBlock Origin, or any other ad blocker for that matter.

We all knew this day was coming, but shots were fired yesterday when this ominous message appeared on the plugin's install page, warning users that uBlock's execution date is drawing near.

Now, this is all part of a grand conspiracy to get you to watch ads and be happy, and Google is achieving that by updating the manifest for plugins from version 2 to version 3,

which eliminates the web request API where plugins can see all the incoming network requests

so they can block all the garbage from known ad servers.

I made a video on this a while ago if you want all the details, but now let's get back to Firefox.

Slovakian company ESET has been credited with discovering and reporting the vulnerability.

Where an attacker is able to achieve code execution by exploiting a use after free flaw in the CSS animation timeline.

I use the animation timeline all the time to create scroll animations on websites that nobody asked for, and never would have expected it to be an attack vector.

But to understand why this is so bad, we need to understand what use after free actually means.

Exploits like this have affected all the other browsers, including Chrome and Safari, and useAfterFree was even responsible for the iOS jailbreak of 2019.

The Firefox browser is free and open source, but you won't find it on GitHub.

Its code is actually self-hosted and uses Mercurial for version control.

It's primarily written in C++, although more and more of its code is now being written in Rust, a language that was created by a software engineer at Mozilla.

Firefox itself contains over 30 million lines of code, because building a browser is extremely complex.

At a high level, here's how a use-after-free flaw could be introduced.

In the C code, let's imagine we need to allocate some memory for a value.

To achieve that, we create a pointer and then use malloc to allocate memory for it.

From there we can assign a value to it and use it in our program to do something useful, like in the case of Firefox, render an animation.

At some later point, when we no longer need that memory, we'll want to deallocate it with free.

But now we have a problem called a dangling pointer.

The memory is free, but the pointer itself still exists and is now being used in our code with undefined behavior.

If an attacker can figure out how to get some malicious code into that memory, it can cause the program to crash, or even worse, remote code execution.

Now, this could be easily fixed by setting the pointer to null or a different object, but in the case of Firefox, the issue is likely a lot more complex and above my pay grade.

It's still being analyzed, so there's not a ton of detail, but Mozilla stated that they have had reports of the vulnerability being exploited in the wild.

The good news, though, is that it's completely fixed, and it doesn't appear anything catastrophic has happened.

In addition, if you're using the anonymous Tor browser, an attacker could take control of your browser, but probably not totally de-anonymize you, assuming you're on Tails OS,

which recently merged with the Tor browser as one project.

Now, another browser that was affected by all this is Zen, which is an awesome open source project based on Firefox.

They quickly update it to the fixed version, but it just goes to show how one little flaw can affect a lot of downstream projects.

But if your goal is to write robust, bulletproof code, you'll need to start with computer science fundamentals.

And you can start doing that today for free thanks to this video's sponsor, Brilliant.

Their quick, rewarding, interactive lessons will help you build a foundation for problem solving that every software engineer needs to have.

Brilliant is where you learn by doing, with thousands of interactive lessons in math, data analysis, programming, and AI.

When you make their Python course a habit with just a few minutes of effort each day, you'll quickly develop the skills needed to build world-changing software.

And you can do it anywhere, even from your phone.

To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash fireship or scan this QR code for 20% off their premium annual subscription.

This has been the Code Report, thanks for watching, and I will see you in the next one.

📺 같은 채널

✨ 추천 영상

364 문장

I Outsmarted Pro Car Thieves

Business EnglishUniversity StudentsWorking Adults

296 문장

Windows Update Shouldn’t Be Allowed to Do This

Business EnglishUniversity StudentsWorking Adults

142 문장

The Internet Didn't Fail. It Was Taken.

Business EnglishDaily ConversationUniversity Students

151 문장

How Ad Blockers Work

Business EnglishUniversity StudentsWorking Adults

26 문장

Two Developers Before a Release: The Login Bug Is Back

Business EnglishDaily ConversationWorking Adults

173 문장

STOP Running Code On Your Computer

Business EnglishUniversity StudentsWorking Adults

185 문장

Use these CSS features instead of JavaScript

Business EnglishUniversity StudentsWorking Adults

532 문장

your home router STILL SUCKS!! (use OPNsense instead)

Business EnglishUniversity StudentsWorking Adults

268 문장

The Shoe That Broke Running

Business EnglishDaily ConversationUniversity Students

211 문장

USB4 is a Glorious Mess

Business EnglishUniversity StudentsWorking Adults

이 레슨의 어휘와 말하기 포인트

이 B2 수준 말하기 레슨은 영상 “Firefox and Tor hit with 9.8 critical level exploit”을(를) 바탕으로 합니다. 가장 자주 반복되는 단어는 다음과 같습니다: code, browser, Firefox, pointer, animation. 이 영상에는 섀도잉할 문장 47개와 단어 991개가 있습니다. 말하는 구간의 길이는 4:27입니다. 화자는 분당 약 223단어로 빠르게 말하므로 연음과 약하게 발음되는 소리가 많습니다. 영어에서 가장 많이 쓰이는 3,000단어에 속하는 단어가 80%뿐이라 어휘가 어려운 편입니다.

이 영상의 핵심 어휘

영상에서 가장 어려운 단어 15개를 발음, 뜻과 함께 정리했습니다.

단어	발음	뜻
exploit 명사	/ˈɛksplɔɪt/	위업, 공훈
pointer 명사	/ˈpɔɪn.təɹ/	교편
animation 명사	/ˌæn.ɪˈmeɪ.ʃən/	애니메이션, 아니메
vulnerability 명사	/ˌvʌln(ə)ɹəˈbɪlɪti/	취약성
interactive 형용사	/ˌɪn.tɚˈæk.tɪv/	인터랙티브
bulletproof 형용사	/ˈbʊlɪtpɹuf/	방탄의
jailbreak 명사	/ˈd͡ʒeɪlˌbɹeɪk/	탈옥
catastrophic 형용사	/ˌkætəˈstɹɑfɪk/	비참한
manifest 명사	/ˈmæn.ɪ.fɛst/	선언
merge 동사	/mɝd͡ʒ/	합하다
render 동사	/ˈɹɛn.dɚ/	일어나게 하다, 하게하다
analyze 동사	/ˈæn.əˌlaɪz/	분석하다
scroll 명사	/skɹoʊl/	두루마리, 스크롤
vector 명사	/ˈvɛktɚ/	벡터
sponsor 명사	/ˈspɒn.səː/	스폰서

이 영상의 문법

화자가 가장 많이 쓰는 문형을 영상 속 실제 표현과 함께 정리했습니다.

문형	영상 속 표현
수동태 be + 과거분사 — 누가 하는지보다 무슨 일이 일어나는지에 초점	were fired · has been credited · being written
현재완료 have/has + 과거분사 — 과거의 일이 지금도 관련이 있을 때	have tabled · has been credited · have affected
관계절 who / which + 절 — 사람이나 사물에 대한 추가 정보	dangling, which is · Zen, which is

주의할 발음

화자는 you're, you'll, doesn't 같은 축약형과 약화된 형태를 13번 사용합니다. 들리는 대로 짧게 발음하세요.

“sh”와 “zh” 소리: animation /ˌæn.ɪˈmeɪ.ʃən/, malicious /məˈlɪʃəs/, subscription /səbˈskɹɪpʃən/
긴 단어 — 강세 위치에 주의: animation /ˌæn.ɪˈmeɪ.ʃən/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, interactive /ˌɪn.tɚˈæk.tɪv/, deallocate /diːˈæləkeɪt/, catastrophic /ˌkætəˈstɹɑfɪk/

한국어 화자가 어려워하는 소리:

/f/ — ㅍ(/p/)으로 바꾸지 말고 윗니를 아랫입술에 대기: flaw /flɔ/, bulletproof /ˈbʊlɪtpɹuf/, terrify /ˈtɛɹɪfaɪ/, catastrophic /ˌkætəˈstɹɑfɪk/, manifest /ˈmæn.ɪ.fɛst/
/v/ — ㅂ(/b/)과 구별하기: vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, interactive /ˌɪn.tɚˈæk.tɪv/, vector /ˈvɛktɚ/
/z/ — ㅈ이 아니라 성대를 울리는 /s/: browser /ˈbɹaʊ.zəɹ/, analyze /ˈæn.əˌlaɪz/

이 영상으로 연습하는 방법

먼저 말하지 않고 영상을 끝까지 듣고 모르는 단어를 적어 둡니다.
0.75배속으로 한 문장씩 섀도잉을 시작하고, 익숙해지면 보통 속도로 돌아갑니다.
자신의 목소리를 녹음해 원본과 비교하고, exploit, pointer, animation 같은 단어에 특히 주의합니다.

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법

쉐도잉(Shadowing)은 원래 전문 통역사 훈련을 위해 개발된 언어 학습 기법으로, 다언어 학자인 Dr. Alexander Arguelles에 의해 대중화된 방법입니다. 핵심 원리는 간단하지만 매우 강력합니다: 원어민의 영어를 들으면서 1~2초의 짧은 지연으로 즉시 소리 내어 따라 말하는 것——마치 '그림자(shadow)'처럼 화자를 따라가는 것입니다. 문법 공부나 수동적인 청취와 달리, 쉐도잉은 뇌와 입 근육이 동시에 실시간으로 영어를 처리하고 재현하도록 훈련합니다. 연구에 따르면 이 방법은 발음 정확도, 억양, 리듬, 연음, 청취력, 말하기 유창성을 크게 향상시킵니다. IELTS 스피킹 준비와 자연스러운 영어 소통을 원하는 분들에게 특히 효과적입니다.

섀도잉 방법: 단계별 전체 가이드 읽기 →

쉐도잉 연습: Firefox and Tor hit with 9.8 critical level exploit - 영상으로 영어 말하기 배우기

OpenAI’s lead engineer was secretly a spy...

PostgreSQL in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Anthropic begged the world to stop AI… then shipped this

A $6.3 billion open-weight model just got embarrassed by the French...

Raspberry Pi Explained in 100 Seconds

100+ Docker Concepts you Need to Know

25 crazy software bugs explained

Git Explained in 100 Seconds

There's a new Linux distro in town for developers...

The "vibe coding" mind virus explained…

Linux got wrecked by backdoor attack

7 Programming myths that waste your time

OpenAI’s new browser feels familiar…

Meta's new model wants "deep access" to your personal life...

Did Google just kickstart the intelligence explosion?

Intel chips can’t possibly be this bad… 100% crash rate?

The most interesting "hack" in history...

Godot in 100 Seconds

Grok 4 pushes humanity closer to AGI… but there’s a problem

I Outsmarted Pro Car Thieves

Windows Update Shouldn’t Be Allowed to Do This

The Internet Didn't Fail. It Was Taken.

How Ad Blockers Work

Two Developers Before a Release: The Login Bug Is Back

STOP Running Code On Your Computer

Use these CSS features instead of JavaScript

your home router STILL SUCKS!! (use OPNsense instead)

The Shoe That Broke Running

USB4 is a Glorious Mess

이 레슨의 어휘와 말하기 포인트

이 영상의 핵심 어휘

이 영상의 문법

주의할 발음

이 영상으로 연습하는 방법

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법