쉐도잉 연습: Linux got wrecked by backdoor attack - 영상으로 영어 말하기 배우기

연습 모드 선택

각 모드는 전체 화면 연습실로 열립니다.

51 문장

문장이 너무 짧거나 길면 Edit를 눌러 조정하세요.

Over the last few days, the open -source world has been in panic mode.

A highly sophisticated and carefully planned attack affecting the XZ compression tool was shipped to production,

and has compromised Linux distros like Debian, Kali, OpenSUSE, and others.

Thank God, TempleOS is unaffected though, and it's quite possibly one of the most well -executed supply chain attacks of all time,

and gives some random dude unfettered access to execute code on your machine via a secret backdoor.

This is not your everyday security vulnerability.

It's a threat -level midnight 10 .0 critical issue on the CVE Richter scale, even higher than famous bugs like Heartbleed, Log4Shell, and Shellshock.

In today's video, you'll learn exactly how the XZ backdoor works, and the incredible story of how it was discovered by accident.

It is April 1st, 2024, and you're watching the Code Report.

Unfortunately, this is not an April Fool's video.

If you happen to be using one of the Linux distros listed here, you'll want to upgrade immediately.

Luckily, it only affects a very narrow set of distros, most of which are unstable builds, but that's only because this backdoor was discovered by pure luck early on.

More on that in just a second, let's first take a deep dive into this backdoor.

XZ -Utils is a tool for compressing and decompressing streams based on the Lempel -Ziv Markov Chain Algorithm, or LZMA.

It contains a command line tool that's installed on most Linux distros by default, which you can use right now with the XZ command, but also contains an API library called lib -LZMA,

and many other pieces of software depend on this library to implement compression, One of which is SSHD, or Secure Shell Daemon, a tool that listens to SSH connections,

like when you connect your local machine to the terminal on a cloud server.

Now here's where the backdoor comes in, but keep in mind, researchers are still figuring out exactly how this thing works.

Malicious code was discovered in the tarballs of LibLZMA, which is the thing that most people actually install.

That malicious code is not present in the source code, though.

It uses a series of obfuscations to hide the malicious code, then at build time, it injects a pre -built object disguised as a test file that lives in the source code.

It modifies specific parts of the LZMA code, which ultimately allows the attacker to intercept and modify data that interacts with this library.

Researchers have also discovered that any payload sent to the backdoor must be signed by the attacker's private key.

In other words, the attacker is the only one who can send a payload to the backdoor, making it more difficult to test and monitor.

And the attacker went to great lengths to obfuscate the code, like it contains no ASCII characters and instead has a built -in state machine to recognize important strings.

Now, because the vast majority of servers that power the internet are Linux -based, this backdoor could have been a major disaster.

Luckily, though, a hero software engineer named Andres Freund was using the unstable branch of Debian to benchmark Postgres.

He noticed something weird that most people would overlook.

SSH logins were using up more CPU resources than normal.

Initially, he thought it was an issue in Debian directly, but after some investigation, discovered it was actually upstream in exeutils.

And that's really bad, because so many things depend on this tool.

In German, his last name translates to friend, which is fitting, because he single -handedly helped the world avoid a multi -billion dollar disaster. But whodunit?

Who's the bad guy here?

At this point, it's unclear.

The LibLZMA project is maintained by Lassie Collin.

However, the malicious tarballs are signed by Gia Tan, a contributor to the project.

This individual has been a trusted contributor for the last few years, but clearly, they've been playing the long game.

They spent years building up trust before trying the backdoor, and nobody even noticed when they made their move.

I say they because we don't know if this is an individual or a penetration attempt from a rogue state like Russia, North Korea, or the United States.

Here's a non -technical analogy.

Imagine there's a landlord, we'll call him Lassie Collin, who manages a popular apartment building.

It's a lot of work, but this young, enthusiastic guy has been super helpful over the last couple years, adding all sorts of upgrades and renovations.

Let's call him Gia Tan.

He does great work, but he's also been secretly installing cameras in the bathrooms, which only he can access from the internet with his password.

Now, he would have gotten away with it too if it weren't for a pesky tenant named Andres, who happened to notice that his electricity bill was just a little bit higher than usual.

He started looking behind the walls and found some unexpected wires that led right to the unauthorized cameras.

At this point, we don't know the true identity of the hacker, but whoever did this was looking to cast a very wide net, and because it's protected by a secret key, can only be exploited by one party.

XZ was a sitting duck because it's extremely popular, while also being very boring with a single maintainer.

Whoever's behind this is either an extremely intelligent psychopath, or more likely, a group of state -sponsored dimension -hopping lizard people hellbent on world domination.

And that's why the only distro you should use is TempleOS.

This has been The Code Report, thanks for watching, and I will see you in the next one.

앱 다운로드

유창하게 말하는 데 필요한 모든 것

AI 발음 평가문장마다 점수 확인

IPA 발음 연습모든 소리 마스터

단어 학습나만의 단어장 만들기

단어 게임놀면서 외우기

QR 스캔

Download on theApp Store Get it onGoogle Play

같은 채널

FOR YOU

이 레슨의 어휘와 말하기 포인트

이 영상에는 섀도잉할 문장 51개와 단어 944개가 있습니다. 말하는 구간의 길이는 4:32입니다. 화자는 분당 약 209단어로 빠르게 말하므로 연음과 약하게 발음되는 소리가 많습니다. 영어에서 가장 많이 쓰이는 3,000단어에 속하는 단어가 76%뿐이라 어휘가 어려운 편입니다.

이 영상의 핵심 어휘

영상에 나오는 덜 흔한 단어 15개를 발음, 뜻과 함께 정리했습니다.

discover /dɪˈskʌvə/ (동사) — 발견하다. To find or learn something for the first time.
server /ˈsɝvɚ/ (명사) — 서버, 봉사기. A program that provides services to other programs or devices, either in the same computer or over a computer network.
disaster /dɪˈzɑːs.təː/ (명사) — 재난, 재앙. An unexpected natural or man-made catastrophe of substantial extent causing significant physical damage or destruction, loss of life or sometimes permanent…
depend /dɪˈpɛnd/ (동사) — 의존하다, ...에 달려 있다. To be contingent or conditioned; to have something as a necessary condition
install /ɪnˈstɔl/ (동사) — 설치하다, 깔다. To connect, set up or prepare something for use
execute /ˈɛksɪˌkjuːt/ (동사) — 처형하다. To kill, especially as punishment for a capital crime.
luckily /ˈlʌk.ɪ.li/ (부사) — 운 좋게, 다행(多幸)히. In a lucky manner; by good fortune; fortunately.
researcher /ˈɹiˌsɝ.t͡ʃɚ/ (명사) — 연구원, 연구자. One who researches.
modify /ˈmɑ.dɪˌfaɪ/ (동사) — 수정하다. To change part of.
vast /væst/ (형용사) — 광대하다, 거대하다. Very large or wide (literally or figuratively).
carefully /ˈkɛɹf(ə)li/ (부사) — 주의하여, 조심스럽게. With care; attentively, circumspectly.
cloud /ˈklaʊ̯d/ (명사) — 구름. A visible mass of water droplets suspended in the air.
wire /ˈwaɪɚ/ (명사) — 철사. Metal formed into a thin, even thread, now usually by being drawn through a hole in a steel die.
hop /hɒp/ (명사) — 홉, 호프. A plant of species Humulus lupulus, native to northern Europe, female flowers of which are used to flavour many types of beer during brewing.
string /stɹɪŋ/ (명사) — 끈. A long, thin and flexible structure made from threads twisted together.

주의할 발음

화자는 don't, you'll, they've 같은 축약형과 약화된 형태를 8번 사용합니다. 들리는 대로 짧게 발음하세요.

“th” 소리: enthusiastic /ɪnˌθjuːzɪˈæstɪk/, psychopath /ˈsaɪkəʊpæθ/
“sh”와 “zh” 소리: malicious /məˈlɪʃəs/, compression /kəmˈpɹɛʃ.ən/, dimension /daɪˈmɛn.ʃən/, renovation /ɹɛnəˈveɪʃən/, penetration /pɛ.nəˈtɹeɪ.ʃən/
긴 단어 — 강세 위치에 주의: contributor /kənˈtɹɪb.jə.tɚ/, electricity /ɪˌlɛkˈtɹɪsɪti/, intelligent /ɪnˈtɛlɪd͡ʒənt/, unexpected /ʌnɪkˈspɛktɪd/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/

이 영상으로 연습하는 방법

먼저 말하지 않고 영상을 끝까지 듣고 모르는 단어를 적어 둡니다.
0.75배속으로 한 문장씩 섀도잉을 시작하고, 익숙해지면 보통 속도로 돌아갑니다.
자신의 목소리를 녹음해 원본과 비교하고, discover, server, disaster 같은 단어에 특히 주의합니다.

이 영상의 문법

화자가 가장 많이 쓰는 문형을 영상 속 실제 표현과 함께 정리했습니다.

문형	영상 속 표현
수동태 be + 과거분사 — 누가 하는지보다 무슨 일이 일어나는지에 초점	was shipped · is unaffected · was discovered
현재완료 have/has + 과거분사 — 과거의 일이 지금도 관련이 있을 때	has been · has compromised · have also discovered
관계절 who / which + 절 — 사람이나 사물에 대한 추가 정보	LibLZMA, which is · one who can · friend, which is

쉐도잉이란? 영어 실력을 빠르게 키우는 과학적 방법

쉐도잉(Shadowing)은 원래 전문 통역사 훈련을 위해 개발된 언어 학습 기법으로, 다언어 학자인 Dr. Alexander Arguelles에 의해 대중화된 방법입니다. 핵심 원리는 간단하지만 매우 강력합니다: 원어민의 영어를 들으면서 1~2초의 짧은 지연으로 즉시 소리 내어 따라 말하는 것——마치 '그림자(shadow)'처럼 화자를 따라가는 것입니다. 문법 공부나 수동적인 청취와 달리, 쉐도잉은 뇌와 입 근육이 동시에 실시간으로 영어를 처리하고 재현하도록 훈련합니다. 연구에 따르면 이 방법은 발음 정확도, 억양, 리듬, 연음, 청취력, 말하기 유창성을 크게 향상시킵니다. IELTS 스피킹 준비와 자연스러운 영어 소통을 원하는 분들에게 특히 효과적입니다.

섀도잉 방법: 단계별 전체 가이드 읽기 →

쉐도잉 연습: Linux got wrecked by backdoor attack - 영상으로 영어 말하기 배우기

연습 모드 선택

앱 다운로드

PostgreSQL in 100 Seconds

React Native in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Brainf**k in 100 Seconds

Mind-bending new programming language for GPUs just dropped...

The plan to break apart Google... RIP Chrome

Docker in 100 Seconds

The worst week in cybersecurity history... so far

The last real programmers are dying out...

Did the AI bubble just pop?

When open-sourcing your code goes wrong...

OpenAI’s new browser feels familiar…

The most interesting "hack" in history...

Tragic mistake... Anthropic leaks Claude’s source code

Firefox and Tor hit with 9.8 critical level exploit

C++ in 100 Seconds

China just dropped a new frontier model... and nobody can explain how

Linux in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

VS Code in 100 Seconds

There's a new Linux distro in town for developers...

you need to learn HACKING RIGHT NOW!! // CEH (ethical hacking)

So I tried Matt's skills...

STOP Running Code On Your Computer

THIS Is Where the Internet Lives

Did Anthropic Kill Git?

Cicada 3301: An Internet Mystery

Debian Linux GNU Coreutils Situation Is Crazy

Running AI Agents in Secure Sandboxes with E2B & Docker MCP | Docker’s AI Guide to the Galaxy

I Tested The Viral Reverse Engineering Repo

Helpdesk to Sysadmin - 3 Things You Must Learn First