Shadowing Practice: Firefox and Tor hit with 9.8 critical level exploit - Learn English Speaking with Video

Last week, we talked about a major exploit discovered in the Chromium-based Arc browser, and all the smart people in the comments were like, thank god I use Firefox.

Unfortunately, the turns have tabled, and now another 9.8 critical vulnerability has crashed into a second browser, this time Firefox.

And this time, it's been actively exploited in the wild.

Now, before you go in the comments and say, thank god I use Tor, it even affects everybody out there doing totally not illegal stuff on the Tor browser, which itself is Firefox-based.

This time, though, it wasn't a silly mistake involving a misconfigured Firebase security rule, but rather a used-after-free flaw on their implementation of the CSS animation timeline property.

They left a pointer dangling, which is far more difficult to detect and audit, and in this case could be used by bad guys to take full control of your browser with remote code execution.

If you're running one of these Firefox versions, you're probably already dead, but if not, you'll want to update immediately.

In today's video, you'll learn all about the interesting and terrifying world of use-after-free exploits.

It is October 15th, 2024, and you're watching the Code Report.

Before we get started, though, I have some other bad news for internet browser users, specifically those on Chrome using uBlock Origin, or any other ad blocker for that matter.

We all knew this day was coming, but shots were fired yesterday when this ominous message appeared on the plugin's install page, warning users that uBlock's execution date is drawing near.

Now, this is all part of a grand conspiracy to get you to watch ads and be happy, and Google is achieving that by updating the manifest for plugins from version 2 to version 3,

which eliminates the web request API where plugins can see all the incoming network requests

so they can block all the garbage from known ad servers.

I made a video on this a while ago if you want all the details, but now let's get back to Firefox.

Slovakian company ESET has been credited with discovering and reporting the vulnerability.

Where an attacker is able to achieve code execution by exploiting a use after free flaw in the CSS animation timeline.

I use the animation timeline all the time to create scroll animations on websites that nobody asked for, and never would have expected it to be an attack vector.

But to understand why this is so bad, we need to understand what use after free actually means.

Exploits like this have affected all the other browsers, including Chrome and Safari, and useAfterFree was even responsible for the iOS jailbreak of 2019.

The Firefox browser is free and open source, but you won't find it on GitHub.

Its code is actually self-hosted and uses Mercurial for version control.

It's primarily written in C++, although more and more of its code is now being written in Rust, a language that was created by a software engineer at Mozilla.

Firefox itself contains over 30 million lines of code, because building a browser is extremely complex.

At a high level, here's how a use-after-free flaw could be introduced.

In the C code, let's imagine we need to allocate some memory for a value.

To achieve that, we create a pointer and then use malloc to allocate memory for it.

From there we can assign a value to it and use it in our program to do something useful, like in the case of Firefox, render an animation.

At some later point, when we no longer need that memory, we'll want to deallocate it with free.

But now we have a problem called a dangling pointer.

The memory is free, but the pointer itself still exists and is now being used in our code with undefined behavior.

If an attacker can figure out how to get some malicious code into that memory, it can cause the program to crash, or even worse, remote code execution.

Now, this could be easily fixed by setting the pointer to null or a different object, but in the case of Firefox, the issue is likely a lot more complex and above my pay grade.

It's still being analyzed, so there's not a ton of detail, but Mozilla stated that they have had reports of the vulnerability being exploited in the wild.

The good news, though, is that it's completely fixed, and it doesn't appear anything catastrophic has happened.

In addition, if you're using the anonymous Tor browser, an attacker could take control of your browser, but probably not totally de-anonymize you, assuming you're on Tails OS,

which recently merged with the Tor browser as one project.

Now, another browser that was affected by all this is Zen, which is an awesome open source project based on Firefox.

They quickly update it to the fixed version, but it just goes to show how one little flaw can affect a lot of downstream projects.

But if your goal is to write robust, bulletproof code, you'll need to start with computer science fundamentals.

And you can start doing that today for free thanks to this video's sponsor, Brilliant.

Their quick, rewarding, interactive lessons will help you build a foundation for problem solving that every software engineer needs to have.

Brilliant is where you learn by doing, with thousands of interactive lessons in math, data analysis, programming, and AI.

When you make their Python course a habit with just a few minutes of effort each day, you'll quickly develop the skills needed to build world-changing software.

And you can do it anywhere, even from your phone.

To try everything Brilliant has to offer for free for 30 days, visit brilliant.org slash fireship or scan this QR code for 20% off their premium annual subscription.

This has been the Code Report, thanks for watching, and I will see you in the next one.

📺 Aynı Kanal

A $6.3 billion open-weight model just got embarrassed by the French...

✨ Video Öner

46 cümleler

OpenAI’s new browser feels familiar…

Business EnglishUniversity StudentsWorking Adults

364 cümleler

I Outsmarted Pro Car Thieves

Business EnglishUniversity StudentsWorking Adults

296 cümleler

Windows Update Shouldn’t Be Allowed to Do This

Business EnglishUniversity StudentsWorking Adults

26 cümleler

Two Developers Before a Release: The Login Bug Is Back

Business EnglishDaily ConversationWorking Adults

151 cümleler

How Ad Blockers Work

Business EnglishUniversity StudentsWorking Adults

142 cümleler

The Internet Didn't Fail. It Was Taken.

Business EnglishDaily ConversationUniversity Students

173 cümleler

STOP Running Code On Your Computer

Business EnglishUniversity StudentsWorking Adults

364 cümleler

World's Deadliest Computer Virus: WannaCry

Business EnglishUniversity StudentsWorking Adults

131 cümleler

The Worst Sponsorships in YouTube History

Business EnglishUniversity StudentsWorking Adults

185 cümleler

Use these CSS features instead of JavaScript

Business EnglishUniversity StudentsWorking Adults

283 cümleler

The Gaming Market is Starting to Break.

Business EnglishUniversity StudentsWorking Adults

Bu dersin kelimeleri ve konuşma notları

Bu B2 seviyesindeki konuşma dersi “Firefox and Tor hit with 9.8 critical level exploit” videosuna dayanıyor. En çok tekrarlanan kelimeler: code, browser, Firefox, pointer, animation. Bu videoda gölgeleme çalışması için 47 cümle ve 991 kelime var. Konuşma bölümü 4:27 sürüyor. Konuşmacı hızlı konuşuyor, dakikada yaklaşık 223 kelime; bu yüzden birbirine bağlanan ve zayıflayan sesler duyacaksınız. Kelimelerin yalnızca %80’i İngilizcede en sık kullanılan 3.000 kelime arasında, bu yüzden kelime dağarcığı zorlayıcı.

Bu videodaki önemli kelimeler

Videodaki en ileri düzey 15 kelime, telaffuzu ve anlamıyla:

Kelime	Telaffuz	Anlam
pointer isim	/ˈpɔɪn.təɹ/	işaret çubuğu
animation isim	/ˌæn.ɪˈmeɪ.ʃən/	animasyon
flaw isim	/flɔ/	çatlak, çizik
vulnerability isim	/ˌvʌln(ə)ɹəˈbɪlɪti/	yaralanabilirlik
allocate fiil	/ˈæl.ə.keɪt/	tahsis etmek, ayırmak
bulletproof sıfat	/ˈbʊlɪtpɹuf/	kurşun geçirmez
jailbreak isim	/ˈd͡ʒeɪlˌbɹeɪk/	hapisten kaçış, hapisten kaçma
ominous sıfat	/ˈɑmɪnəs/	uğursuz, meşum
terrify fiil	/ˈtɛɹɪfaɪ/	dehşete düşürmek
malicious sıfat	/məˈlɪʃəs/	kötü niyetli, kötü amaçlı
manifest isim	/ˈmæn.ɪ.fɛst/	gümrük bildirimi
merge fiil	/mɝd͡ʒ/	birleştirmek, birleşmek
render fiil	/ˈɹɛn.dɚ/	eylemek
scroll isim	/skɹoʊl/	tomar
vector isim	/ˈvɛktɚ/	vektör, yöney

Duyacağınız deyimsel fiiller

Kelime	Anlam
figure out fiil	açığa çıkarmak

Bu videodaki dil bilgisi

Konuşmacının en çok kullandığı yapılar, videodaki sözcüklerin aynısıyla:

Yapı	Videoda
Edilgen yapı be + fiilin üçüncü hâli — kimin yaptığı değil, ne olduğu önemli	were fired · has been credited · being written
Present perfect have/has + fiilin üçüncü hâli — geçmişte olan ama şimdi de önemli olan bir eylem	have tabled · has been credited · have affected
İlgi cümlecikleri who / which + cümle — bir kişi ya da şey hakkında ek bilgi	dangling, which is · Zen, which is

Dikkat edilecek telaffuzlar

Konuşmacı you're, you'll, doesn't gibi kısaltılmış biçimleri 13 kez kullanıyor. Bunları duyduğunuz gibi kısa söyleyin.

“sh” ve “zh” sesleri: animation /ˌæn.ɪˈmeɪ.ʃən/, malicious /məˈlɪʃəs/, subscription /səbˈskɹɪpʃən/
Uzun kelimeler — vurguyu doğru yere koyun: animation /ˌæn.ɪˈmeɪ.ʃən/, vulnerability /ˌvʌln(ə)ɹəˈbɪlɪti/, interactive /ˌɪn.tɚˈæk.tɪv/, deallocate /diːˈæləkeɪt/, catastrophic /ˌkætəˈstɹɑfɪk/

Türkçe konuşanların zorlandığı sesler:

Kelime başındaki ünsüz kümesi — araya ünlü eklemeyin: browser /ˈbɹaʊ.zəɹ/, flaw /flɔ/, blocker /ˈblɑkɚ/, scroll /skɹoʊl/, sponsor /ˈspɒn.səː/
/æ/ — “e”den daha açık: animation /ˌæn.ɪˈmeɪ.ʃən/, attacker /əˈtækɚ/, allocate /ˈæl.ə.keɪt/, dangle /ˈdæŋ.ɡəl/, interactive /ˌɪn.tɚˈæk.tɪv/

Bu videoyla nasıl çalışılır

Videonun tamamını konuşmadan bir kez dinleyin ve bilmediğiniz kelimeleri not edin.
0,75× hızla başlayın, cümle cümle tekrar edin ve kolaylaşınca normal hıza dönün.
Kendinizi kaydedin ve orijinaliyle karşılaştırın; pointer, animation, flaw gibi kelimelere özellikle dikkat edin.

Gölgeleme Tekniği Nedir?

Gölgeleme, başlangıçta profesyonel tercüman eğitimi için geliştirilen ve çok dilli Dr. Alexander Arguelles tarafından popüler hale getirilen, bilim destekli bir dil öğrenme tekniğidir. Yöntem basit ama güçlüdür: ana dili İngilizce olan bir sesi dinler ve hemen yüksek sesle tekrar edersiniz — konuşmacıyı 1-2 saniye gecikmeyle takip eden bir gölge gibi. Pasif dinleme veya dilbilgisi alıştırmalarının aksine, gölgeleme beyninizi ve ağız kaslarınızı gerçek konuşma kalıplarını eşzamanlı olarak işlemeye ve yeniden üretmeye zorlar. Araştırmalar, telaffuz doğruluğu, tonlama, ritim, bağlı konuşma, dinleme anlama ve konuşma akıcılığını önemli ölçüde geliştirdiğini göstermektedir — bu da onu IELTS Konuşma hazırlığı ve gerçek dünya İngilizce iletişimi için en etkili yöntemlerden biri yapar.

Shadowing tekniği: adım adım eksiksiz rehberi okuyun →

Shadowing Practice: Firefox and Tor hit with 9.8 critical level exploit - Learn English Speaking with Video

A $6.3 billion open-weight model just got embarrassed by the French...

PostgreSQL in 100 Seconds

DNS Explained in 100 Seconds

Anthropic begged the world to stop AI… then shipped this

One man just liberated Fable... and now it’s illegal

7 Things No Programmer Ever Wants to Hear

80% of programmers are NOT happy… why?

Raspberry Pi Explained in 100 Seconds

Tragic mistake... Anthropic leaks Claude’s source code

100+ Docker Concepts you Need to Know

Docker in 100 Seconds

The mystery is solved... and the answer is 40x cheaper than Claude

An ex-OpenAI researcher just deleted language from the LLM...

25 crazy software bugs explained

Git Explained in 100 Seconds

There's a new Linux distro in town for developers...

The "vibe coding" mind virus explained…

Linux got wrecked by backdoor attack

7 Programming myths that waste your time

Nvidia CUDA in 100 Seconds

OpenAI’s new browser feels familiar…

I Outsmarted Pro Car Thieves

Windows Update Shouldn’t Be Allowed to Do This

Two Developers Before a Release: The Login Bug Is Back

How Ad Blockers Work

The Internet Didn't Fail. It Was Taken.

STOP Running Code On Your Computer

World's Deadliest Computer Virus: WannaCry

The Worst Sponsorships in YouTube History

Use these CSS features instead of JavaScript

The Gaming Market is Starting to Break.

Bu dersin kelimeleri ve konuşma notları

Bu videodaki önemli kelimeler

Duyacağınız deyimsel fiiller

Bu videodaki dil bilgisi

Dikkat edilecek telaffuzlar

Bu videoyla nasıl çalışılır

Gölgeleme Tekniği Nedir?