Luyện nói tiếng Anh bằng Shadowing qua video: Linux got wrecked by backdoor attack

Chọn chế độ luyện tập

Mỗi chế độ mở một phòng luyện tập toàn màn hình.

51 câu
Nếu các câu quá ngắn hoặc quá dài, hãy bấm Edit để chỉnh sửa.
1
Over the last few days, the open -source world has been in panic mode.
2
A highly sophisticated and carefully planned attack affecting the XZ compression tool was shipped to production,
3
and has compromised Linux distros like Debian, Kali, OpenSUSE, and others.
4
Thank God, TempleOS is unaffected though, and it's quite possibly one of the most well -executed supply chain attacks of all time,
5
and gives some random dude unfettered access to execute code on your machine via a secret backdoor.
6
This is not your everyday security vulnerability.
7
It's a threat -level midnight 10 .0 critical issue on the CVE Richter scale, even higher than famous bugs like Heartbleed, Log4Shell, and Shellshock.
8
In today's video, you'll learn exactly how the XZ backdoor works, and the incredible story of how it was discovered by accident.
9
It is April 1st, 2024, and you're watching the Code Report.
10
Unfortunately, this is not an April Fool's video.
11
If you happen to be using one of the Linux distros listed here, you'll want to upgrade immediately.
12
Luckily, it only affects a very narrow set of distros, most of which are unstable builds, but that's only because this backdoor was discovered by pure luck early on.
13
More on that in just a second, let's first take a deep dive into this backdoor.
14
XZ -Utils is a tool for compressing and decompressing streams based on the Lempel -Ziv Markov Chain Algorithm, or LZMA.
15
It contains a command line tool that's installed on most Linux distros by default, which you can use right now with the XZ command, but also contains an API library called lib -LZMA,
16
and many other pieces of software depend on this library to implement compression, One of which is SSHD, or Secure Shell Daemon, a tool that listens to SSH connections,
17
like when you connect your local machine to the terminal on a cloud server.
18
Now here's where the backdoor comes in, but keep in mind, researchers are still figuring out exactly how this thing works.
19
Malicious code was discovered in the tarballs of LibLZMA, which is the thing that most people actually install.
20
That malicious code is not present in the source code, though.
21
It uses a series of obfuscations to hide the malicious code, then at build time, it injects a pre -built object disguised as a test file that lives in the source code.
22
It modifies specific parts of the LZMA code, which ultimately allows the attacker to intercept and modify data that interacts with this library.
23
Researchers have also discovered that any payload sent to the backdoor must be signed by the attacker's private key.
24
In other words, the attacker is the only one who can send a payload to the backdoor, making it more difficult to test and monitor.
25
And the attacker went to great lengths to obfuscate the code, like it contains no ASCII characters and instead has a built -in state machine to recognize important strings.
26
Now, because the vast majority of servers that power the internet are Linux -based, this backdoor could have been a major disaster.
27
Luckily, though, a hero software engineer named Andres Freund was using the unstable branch of Debian to benchmark Postgres.
28
He noticed something weird that most people would overlook.
29
SSH logins were using up more CPU resources than normal.
30
Initially, he thought it was an issue in Debian directly, but after some investigation, discovered it was actually upstream in exeutils.
31
And that's really bad, because so many things depend on this tool.
32
In German, his last name translates to friend, which is fitting, because he single -handedly helped the world avoid a multi -billion dollar disaster. But whodunit?
33
Who's the bad guy here?
34
At this point, it's unclear.
35
The LibLZMA project is maintained by Lassie Collin.
36
However, the malicious tarballs are signed by Gia Tan, a contributor to the project.
37
This individual has been a trusted contributor for the last few years, but clearly, they've been playing the long game.
38
They spent years building up trust before trying the backdoor, and nobody even noticed when they made their move.
39
I say they because we don't know if this is an individual or a penetration attempt from a rogue state like Russia, North Korea, or the United States.
40
Here's a non -technical analogy.
41
Imagine there's a landlord, we'll call him Lassie Collin, who manages a popular apartment building.
42
It's a lot of work, but this young, enthusiastic guy has been super helpful over the last couple years, adding all sorts of upgrades and renovations.
43
Let's call him Gia Tan.
44
He does great work, but he's also been secretly installing cameras in the bathrooms, which only he can access from the internet with his password.
45
Now, he would have gotten away with it too if it weren't for a pesky tenant named Andres, who happened to notice that his electricity bill was just a little bit higher than usual.
46
He started looking behind the walls and found some unexpected wires that led right to the unauthorized cameras.
47
At this point, we don't know the true identity of the hacker, but whoever did this was looking to cast a very wide net, and because it's protected by a secret key, can only be exploited by one party.
48
XZ was a sitting duck because it's extremely popular, while also being very boring with a single maintainer.
49
Whoever's behind this is either an extremely intelligent psychopath, or more likely, a group of state -sponsored dimension -hopping lizard people hellbent on world domination.
50
And that's why the only distro you should use is TempleOS.
51
This has been The Code Report, thanks for watching, and I will see you in the next one.

Tải Ứng Dụng

Mọi thứ bạn cần để nói trôi chảy

Chấm điểm AIChấm từng câu nói
Luyện IPAThành thạo mọi âm
Từ vựngMở rộng vốn từ
Game Từ vựngHọc qua chơi

Cùng kênh

FOR YOU

Video gợi ý

Từ vựng và ghi chú luyện nói cho bài học này

Video này có 51 câu và 944 từ để luyện shadowing. Phần lời nói dài 4:32. Người nói nói nhanh, khoảng 209 từ mỗi phút, nên sẽ có nhiều chỗ nối âm và nuốt âm. Chỉ 76% số từ nằm trong 3.000 từ tiếng Anh thông dụng nhất, nên từ vựng khá khó.

Từ vựng quan trọng trong video

15 từ ít gặp trong video, kèm phiên âm và nghĩa:

  • discover /dɪˈskʌvə/ (động từ) — phát hiện, phát kiến. To find or learn something for the first time.
  • server /ˈsɝvɚ/ (danh từ) — trình chủ, máy chủ. A program that provides services to other programs or devices, either in the same computer or over a computer network.
  • disaster /dɪˈzɑːs.təː/ (danh từ) — tai hoạ, thảm hoạ. An unexpected natural or man-made catastrophe of substantial extent causing significant physical damage or destruction, loss of life or sometimes permanent…
  • depend /dɪˈpɛnd/ (động từ) — phụ thuộc. To be contingent or conditioned; to have something as a necessary condition
  • install /ɪnˈstɔl/ (động từ) — cài đặt. To connect, set up or prepare something for use
  • luckily /ˈlʌk.ɪ.li/ (trạng từ) — may, may mắn. In a lucky manner; by good fortune; fortunately.
  • researcher /ˈɹiˌsɝ.t͡ʃɚ/ (danh từ) — nhà nghiên cứu. One who researches.
  • everyday /ˈɛvɹiˌdeɪ/ (tính từ) — hằng ngày, thường ngày. Appropriate for ordinary use, rather than for special occasions.
  • cloud /ˈklaʊ̯d/ (danh từ) — mây. A visible mass of water droplets suspended in the air.
  • helpful /ˈhɛlp.fl̩/ (tính từ) — hay giúp đỡ. Furnishing help; giving aid; useful.
  • wire /ˈwaɪɚ/ (danh từ) — dây, dây thép. Metal formed into a thin, even thread, now usually by being drawn through a hole in a steel die.
  • hop /hɒp/ (danh từ) — hoa bia. A plant of species Humulus lupulus, native to northern Europe, female flowers of which are used to flavour many types of beer during brewing.
  • string /stɹɪŋ/ (danh từ) — chuỗi. A long, thin and flexible structure made from threads twisted together.
  • narrow /ˈnæɹəʊ/ (tính từ) — hẹp, chật hẹp. Having a small width; not wide; having opposite edges or sides that are close, especially by comparison to length or depth.
  • resource /ɹɪˈzɔːs/ (danh từ) — tài nguyên. Something that one uses to achieve an objective, e.g. raw materials or personnel.

Phát âm cần chú ý

Người nói dùng 8 dạng rút gọn, ví dụ don't, you'll, they've. Hãy nói theo dạng ngắn đúng như bạn nghe.

  • Âm “th”: enthusiastic /ɪnˌθjuːzɪˈæstɪk/, psychopath /ˈsaɪkəʊpæθ/
  • Âm “sh” và “zh”: malicious /məˈlɪʃəs/, compression /kəmˈpɹɛʃ.ən/, dimension /daɪˈmɛn.ʃən/, renovation /ɹɛnəˈveɪʃən/, penetration /pɛ.nəˈtɹeɪ.ʃən/
  • Từ dài — đặt trọng âm cho đúng: contributor /kənˈtɹɪb.jə.tɚ/, electricity /ɪˌlɛkˈtɹɪsɪti/, intelligent /ɪnˈtɛlɪd͡ʒənt/, unexpected /ʌnɪkˈspɛktɪd/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/

Cách luyện với video này

  1. Nghe hết video một lần, chưa cần nói, và ghi lại những từ bạn chưa biết.
  2. Bắt đầu ở tốc độ 0,75×, nói đuổi từng câu, rồi quay lại tốc độ bình thường khi đã quen.
  3. Ghi âm giọng mình rồi so với bản gốc, chú ý các từ như discover, server, disaster.

Ngữ pháp trong video

Những cấu trúc người nói dùng nhiều nhất, kèm đúng cụm từ trong video:

Cấu trúcTrong video
Câu bị động be + quá khứ phân từ — nhấn vào việc xảy ra, không phải người làmwas shipped · is unaffected · was discovered
Thì hiện tại hoàn thành have/has + quá khứ phân từ — việc đã xảy ra nhưng còn liên quan đến hiện tạihas been · has compromised · have also discovered
Mệnh đề quan hệ who / which + mệnh đề — thêm thông tin về người hoặc vậtLibLZMA, which is · one who can · friend, which is

Phương Pháp Shadowing Là Gì?

Shadowing là kỹ thuật học ngôn ngữ có cơ sở khoa học, ban đầu được phát triển cho chương trình đào tạo phiên dịch viên chuyên nghiệp và được phổ biến rộng rãi bởi nhà đa ngôn ngữ học Dr. Alexander Arguelles. Nguyên lý cốt lõi đơn giản nhưng cực kỳ hiệu quả: bạn nghe tiếng Anh của người bản xứ và lặp lại to ngay lập tức — như một "cái bóng" (shadow) đuổi theo người nói với độ trễ chỉ 1–2 giây. Khác với luyện ngữ pháp hay học từ vựng bị động, Shadowing buộc não bộ và cơ miệng phải đồng thời xử lý và tái tạo ngôn ngữ thực tế. Các nghiên cứu khoa học xác nhận phương pháp này cải thiện đáng kể phát âm, ngữ điệu, nhịp điệu, nối âm, kỹ năng nghe và độ lưu loát khi nói — đặc biệt hiệu quả cho người luyện IELTS Speaking và muốn giao tiếp tiếng Anh tự nhiên như người bản ngữ.

Phương pháp shadowing: đọc hướng dẫn từng bước đầy đủ →