跟讀練習: Linux got wrecked by backdoor attack - 通過影片學習英語口語

選擇練習模式

每種模式都會開啟全屏練習室。

51 句

如果句子過短或過長，請點選 Edit 進行調整。

Over the last few days, the open -source world has been in panic mode.

A highly sophisticated and carefully planned attack affecting the XZ compression tool was shipped to production,

and has compromised Linux distros like Debian, Kali, OpenSUSE, and others.

Thank God, TempleOS is unaffected though, and it's quite possibly one of the most well -executed supply chain attacks of all time,

and gives some random dude unfettered access to execute code on your machine via a secret backdoor.

This is not your everyday security vulnerability.

It's a threat -level midnight 10 .0 critical issue on the CVE Richter scale, even higher than famous bugs like Heartbleed, Log4Shell, and Shellshock.

In today's video, you'll learn exactly how the XZ backdoor works, and the incredible story of how it was discovered by accident.

It is April 1st, 2024, and you're watching the Code Report.

Unfortunately, this is not an April Fool's video.

If you happen to be using one of the Linux distros listed here, you'll want to upgrade immediately.

Luckily, it only affects a very narrow set of distros, most of which are unstable builds, but that's only because this backdoor was discovered by pure luck early on.

More on that in just a second, let's first take a deep dive into this backdoor.

XZ -Utils is a tool for compressing and decompressing streams based on the Lempel -Ziv Markov Chain Algorithm, or LZMA.

It contains a command line tool that's installed on most Linux distros by default, which you can use right now with the XZ command, but also contains an API library called lib -LZMA,

and many other pieces of software depend on this library to implement compression, One of which is SSHD, or Secure Shell Daemon, a tool that listens to SSH connections,

like when you connect your local machine to the terminal on a cloud server.

Now here's where the backdoor comes in, but keep in mind, researchers are still figuring out exactly how this thing works.

Malicious code was discovered in the tarballs of LibLZMA, which is the thing that most people actually install.

That malicious code is not present in the source code, though.

It uses a series of obfuscations to hide the malicious code, then at build time, it injects a pre -built object disguised as a test file that lives in the source code.

It modifies specific parts of the LZMA code, which ultimately allows the attacker to intercept and modify data that interacts with this library.

Researchers have also discovered that any payload sent to the backdoor must be signed by the attacker's private key.

In other words, the attacker is the only one who can send a payload to the backdoor, making it more difficult to test and monitor.

And the attacker went to great lengths to obfuscate the code, like it contains no ASCII characters and instead has a built -in state machine to recognize important strings.

Now, because the vast majority of servers that power the internet are Linux -based, this backdoor could have been a major disaster.

Luckily, though, a hero software engineer named Andres Freund was using the unstable branch of Debian to benchmark Postgres.

He noticed something weird that most people would overlook.

SSH logins were using up more CPU resources than normal.

Initially, he thought it was an issue in Debian directly, but after some investigation, discovered it was actually upstream in exeutils.

And that's really bad, because so many things depend on this tool.

In German, his last name translates to friend, which is fitting, because he single -handedly helped the world avoid a multi -billion dollar disaster. But whodunit?

Who's the bad guy here?

At this point, it's unclear.

The LibLZMA project is maintained by Lassie Collin.

However, the malicious tarballs are signed by Gia Tan, a contributor to the project.

This individual has been a trusted contributor for the last few years, but clearly, they've been playing the long game.

They spent years building up trust before trying the backdoor, and nobody even noticed when they made their move.

I say they because we don't know if this is an individual or a penetration attempt from a rogue state like Russia, North Korea, or the United States.

Here's a non -technical analogy.

Imagine there's a landlord, we'll call him Lassie Collin, who manages a popular apartment building.

It's a lot of work, but this young, enthusiastic guy has been super helpful over the last couple years, adding all sorts of upgrades and renovations.

Let's call him Gia Tan.

He does great work, but he's also been secretly installing cameras in the bathrooms, which only he can access from the internet with his password.

Now, he would have gotten away with it too if it weren't for a pesky tenant named Andres, who happened to notice that his electricity bill was just a little bit higher than usual.

He started looking behind the walls and found some unexpected wires that led right to the unauthorized cameras.

At this point, we don't know the true identity of the hacker, but whoever did this was looking to cast a very wide net, and because it's protected by a secret key, can only be exploited by one party.

XZ was a sitting duck because it's extremely popular, while also being very boring with a single maintainer.

Whoever's behind this is either an extremely intelligent psychopath, or more likely, a group of state -sponsored dimension -hopping lizard people hellbent on world domination.

And that's why the only distro you should use is TempleOS.

This has been The Code Report, thanks for watching, and I will see you in the next one.

下載應用

流利口語所需的一切

AI 發音評分逐句打分

音標練習掌握每個音

詞彙學習建立你的詞庫

詞彙遊戲邊玩邊學

掃碼

Download on theApp Store Get it onGoogle Play

同頻道

FOR YOU

本課的詞彙與口語要點

這段影片共有 51 個句子、944 個單詞可供跟讀。講話部分時長為 4:32。說話人語速較快，每分鐘約 209 個詞，會出現較多連讀和弱讀。只有 76% 的單詞屬於英語最常用的 3,000 詞，詞彙難度較高。

影片中的重點詞彙

影片中 15 個不太常見的單詞，附發音和釋義：

discover /dɪˈskʌvə/ (動詞) — 發現 /發現, 發覺 /發覺. To find or learn something for the first time.
malicious /məˈlɪʃəs/ (形容詞) — 惡意的 /惡意的, 惡毒的 /惡毒的. Intending to do harm; characterized by spite and malice.
server /ˈsɝvɚ/ (名詞) — 伺服器 /伺服器, 伺服器. A program that provides services to other programs or devices, either in the same computer or over a computer network.
disaster /dɪˈzɑːs.təː/ (名詞) — 災難 /災難, 災害 /災害. An unexpected natural or man-made catastrophe of substantial extent causing significant physical damage or destruction, loss of life or sometimes permanent…
depend /dɪˈpɛnd/ (動詞) — 信任, 信賴 /信賴. To be contingent or conditioned; to have something as a necessary condition
install /ɪnˈstɔl/ (動詞) — 安裝 /安裝. To connect, set up or prepare something for use
execute /ˈɛksɪˌkjuːt/ (動詞) — 處決 /處決, 處死 /處死. To kill, especially as punishment for a capital crime.
luckily /ˈlʌk.ɪ.li/ (副詞) — 好在, 所幸. In a lucky manner; by good fortune; fortunately.
researcher /ˈɹiˌsɝ.t͡ʃɚ/ (名詞) — 研究員 /研究員, 研究者. One who researches.
modify /ˈmɑ.dɪˌfaɪ/ (動詞) — 修改. To change part of.
vast /væst/ (形容詞) — 浩大. Very large or wide (literally or figuratively).
everyday /ˈɛvɹiˌdeɪ/ (形容詞) — 日常的. Appropriate for ordinary use, rather than for special occasions.
carefully /ˈkɛɹf(ə)li/ (副詞) — 小心地. With care; attentively, circumspectly.
cloud /ˈklaʊ̯d/ (名詞) — йүн, 雲 /雲. A visible mass of water droplets suspended in the air.
helpful /ˈhɛlp.fl̩/ (形容詞) — 有幫助 /有幫助. Furnishing help; giving aid; useful.

影片中出現的短語動詞

figure out (動詞) — 弄清楚. To come to understand; to discover or find a solution; to deduce.

需要注意的發音

說話人用了 8 次縮略和弱讀形式，例如 don't, you'll, they've。請按聽到的簡短形式來說。

“th” 音: enthusiastic /ɪnˌθjuːzɪˈæstɪk/, psychopath /ˈsaɪkəʊpæθ/
“sh” 和 “zh” 音: malicious /məˈlɪʃəs/, compression /kəmˈpɹɛʃ.ən/, dimension /daɪˈmɛn.ʃən/, renovation /ɹɛnəˈveɪʃən/, penetration /pɛ.nəˈtɹeɪ.ʃən/
長單詞——注意重音位置: contributor /kənˈtɹɪb.jə.tɚ/, electricity /ɪˌlɛkˈtɹɪsɪti/, intelligent /ɪnˈtɛlɪd͡ʒənt/, unexpected /ʌnɪkˈspɛktɪd/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/

如何用這段影片練習

先完整聽一遍影片，不要開口，記下不認識的單詞。
先用 0.75 倍速逐句跟讀，熟練之後再回到正常速度。
錄下自己的聲音並與原聲對比，特別注意 discover, malicious, server 這類單詞。

影片中的語法

說話人最常用的結構，並附上影片中的原話：

結構	影片中的用法
被動語態 be + 過去分詞 — 強調發生了什麼，而不是誰做的	was shipped · is unaffected · was discovered
現在完成時 have/has + 過去分詞 — 過去發生但與現在仍有關聯的事	has been · has compromised · have also discovered
定語從句 who / which + 從句 — 補充說明人或事物	LibLZMA, which is · one who can · friend, which is

什麼是跟讀法？

跟讀法 (Shadowing) 是一種有科學依據的語言學習技巧，最初開發用於專業口譯員的培訓，並由多語言者Alexander Arguelles博士普及。這個方法簡單而強大：您在聽英語母語原聲的同時立即大聲重複——就像是一個延遲1-2秒緊跟說話者的影子。與被動聽力或語法練習不同，跟讀法強迫您的大腦和口腔肌肉同時處理並模模擬實的講話模式。研究表明它能顯著提高發音準確性，語調，節奏，連讀，聽力理解和口語流利度——使其成為雅思口語備考和真實英語交流最有效的方法之一。

影子跟讀法: 閱讀完整分步指南 →

跟讀練習: Linux got wrecked by backdoor attack - 通過影片學習英語口語

選擇練習模式

下載應用

The last real programmers are dying out...

PostgreSQL in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

A $6.3 billion open-weight model just got embarrassed by the French...

Every app on Earth is now open source... whether it likes it or not

OpenAI’s lead engineer was secretly a spy...

Mind-bending new programming language for GPUs just dropped...

Intel chips can’t possibly be this bad… 100% crash rate?

Godot in 100 Seconds

Grok 4 pushes humanity closer to AGI… but there’s a problem

Array Map in 100 Seconds

Docker in 100 Seconds

The most interesting "hack" in history...

OpenAI’s new browser feels familiar…

10 weird OSS projects you need right now...

Firefox and Tor hit with 9.8 critical level exploit

5 open source tools that replaced my $320/mo AI stack...

C++ in 100 Seconds

DHH has gone completely off the rails...

Rust in 100 Seconds

STOP Running Code On Your Computer

There's a new Linux distro in town for developers...

Cicada 3301: An Internet Mystery

Did Anthropic Kill Git?

Something is jamming GPS over Europe. Here's what we found

What is Docker? Docker container concept explained || Docker Tutorial 1

Debian Linux GNU Coreutils Situation Is Crazy

Why Ukraine Is Doomed | Episode 6

The Anatomy of Fraud

Go’s Big Mistake

JUST $1 For Billions of Tokens?! (DeepSeek v4 Pro)