跟读练习: Linux got wrecked by backdoor attack - 通过视频学习英语口语

选择练习模式

每种模式都会打开全屏练习室。

51 句

如果句子过短或过长，请点击 Edit 进行调整。

Over the last few days, the open -source world has been in panic mode.

A highly sophisticated and carefully planned attack affecting the XZ compression tool was shipped to production,

and has compromised Linux distros like Debian, Kali, OpenSUSE, and others.

Thank God, TempleOS is unaffected though, and it's quite possibly one of the most well -executed supply chain attacks of all time,

and gives some random dude unfettered access to execute code on your machine via a secret backdoor.

This is not your everyday security vulnerability.

It's a threat -level midnight 10 .0 critical issue on the CVE Richter scale, even higher than famous bugs like Heartbleed, Log4Shell, and Shellshock.

In today's video, you'll learn exactly how the XZ backdoor works, and the incredible story of how it was discovered by accident.

It is April 1st, 2024, and you're watching the Code Report.

Unfortunately, this is not an April Fool's video.

If you happen to be using one of the Linux distros listed here, you'll want to upgrade immediately.

Luckily, it only affects a very narrow set of distros, most of which are unstable builds, but that's only because this backdoor was discovered by pure luck early on.

More on that in just a second, let's first take a deep dive into this backdoor.

XZ -Utils is a tool for compressing and decompressing streams based on the Lempel -Ziv Markov Chain Algorithm, or LZMA.

It contains a command line tool that's installed on most Linux distros by default, which you can use right now with the XZ command, but also contains an API library called lib -LZMA,

and many other pieces of software depend on this library to implement compression, One of which is SSHD, or Secure Shell Daemon, a tool that listens to SSH connections,

like when you connect your local machine to the terminal on a cloud server.

Now here's where the backdoor comes in, but keep in mind, researchers are still figuring out exactly how this thing works.

Malicious code was discovered in the tarballs of LibLZMA, which is the thing that most people actually install.

That malicious code is not present in the source code, though.

It uses a series of obfuscations to hide the malicious code, then at build time, it injects a pre -built object disguised as a test file that lives in the source code.

It modifies specific parts of the LZMA code, which ultimately allows the attacker to intercept and modify data that interacts with this library.

Researchers have also discovered that any payload sent to the backdoor must be signed by the attacker's private key.

In other words, the attacker is the only one who can send a payload to the backdoor, making it more difficult to test and monitor.

And the attacker went to great lengths to obfuscate the code, like it contains no ASCII characters and instead has a built -in state machine to recognize important strings.

Now, because the vast majority of servers that power the internet are Linux -based, this backdoor could have been a major disaster.

Luckily, though, a hero software engineer named Andres Freund was using the unstable branch of Debian to benchmark Postgres.

He noticed something weird that most people would overlook.

SSH logins were using up more CPU resources than normal.

Initially, he thought it was an issue in Debian directly, but after some investigation, discovered it was actually upstream in exeutils.

And that's really bad, because so many things depend on this tool.

In German, his last name translates to friend, which is fitting, because he single -handedly helped the world avoid a multi -billion dollar disaster. But whodunit?

Who's the bad guy here?

At this point, it's unclear.

The LibLZMA project is maintained by Lassie Collin.

However, the malicious tarballs are signed by Gia Tan, a contributor to the project.

This individual has been a trusted contributor for the last few years, but clearly, they've been playing the long game.

They spent years building up trust before trying the backdoor, and nobody even noticed when they made their move.

I say they because we don't know if this is an individual or a penetration attempt from a rogue state like Russia, North Korea, or the United States.

Here's a non -technical analogy.

Imagine there's a landlord, we'll call him Lassie Collin, who manages a popular apartment building.

It's a lot of work, but this young, enthusiastic guy has been super helpful over the last couple years, adding all sorts of upgrades and renovations.

Let's call him Gia Tan.

He does great work, but he's also been secretly installing cameras in the bathrooms, which only he can access from the internet with his password.

Now, he would have gotten away with it too if it weren't for a pesky tenant named Andres, who happened to notice that his electricity bill was just a little bit higher than usual.

He started looking behind the walls and found some unexpected wires that led right to the unauthorized cameras.

At this point, we don't know the true identity of the hacker, but whoever did this was looking to cast a very wide net, and because it's protected by a secret key, can only be exploited by one party.

XZ was a sitting duck because it's extremely popular, while also being very boring with a single maintainer.

Whoever's behind this is either an extremely intelligent psychopath, or more likely, a group of state -sponsored dimension -hopping lizard people hellbent on world domination.

And that's why the only distro you should use is TempleOS.

This has been The Code Report, thanks for watching, and I will see you in the next one.

下载应用

流利口语所需的一切

AI 发音评分逐句打分

音标练习掌握每个音

词汇学习建立你的词库

词汇游戏边玩边学

扫码

Download on theApp Store Get it onGoogle Play

同频道

FOR YOU

本课的词汇与口语要点

这段视频共有 51 个句子、944 个单词可供跟读。讲话部分时长为 4:32。说话人语速较快，每分钟约 209 个词，会出现较多连读和弱读。只有 76% 的单词属于英语最常用的 3,000 词，词汇难度较高。

视频中的重点词汇

视频中 15 个不太常见的单词，附发音和释义：

discover /dɪˈskʌvə/ (动词) — 發現 /发现, 發覺 /发觉. To find or learn something for the first time.
malicious /məˈlɪʃəs/ (形容词) — 惡意的 /恶意的, 惡毒的 /恶毒的. Intending to do harm; characterized by spite and malice.
server /ˈsɝvɚ/ (名词) — 服務器 /服务器, 伺服器. A program that provides services to other programs or devices, either in the same computer or over a computer network.
disaster /dɪˈzɑːs.təː/ (名词) — 災難 /灾难, 災害 /灾害. An unexpected natural or man-made catastrophe of substantial extent causing significant physical damage or destruction, loss of life or sometimes permanent…
depend /dɪˈpɛnd/ (动词) — 信任, 信賴 /信赖. To be contingent or conditioned; to have something as a necessary condition
install /ɪnˈstɔl/ (动词) — 安裝 /安装. To connect, set up or prepare something for use
execute /ˈɛksɪˌkjuːt/ (动词) — 處決 /处决, 處死 /处死. To kill, especially as punishment for a capital crime.
luckily /ˈlʌk.ɪ.li/ (副词) — 好在, 所幸. In a lucky manner; by good fortune; fortunately.
researcher /ˈɹiˌsɝ.t͡ʃɚ/ (名词) — 研究員 /研究员, 研究者. One who researches.
modify /ˈmɑ.dɪˌfaɪ/ (动词) — 修改. To change part of.
vast /væst/ (形容词) — 浩大. Very large or wide (literally or figuratively).
everyday /ˈɛvɹiˌdeɪ/ (形容词) — 日常的. Appropriate for ordinary use, rather than for special occasions.
carefully /ˈkɛɹf(ə)li/ (副词) — 小心地. With care; attentively, circumspectly.
cloud /ˈklaʊ̯d/ (名词) — йүн, 雲 /云. A visible mass of water droplets suspended in the air.
helpful /ˈhɛlp.fl̩/ (形容词) — 有幫助 /有帮助. Furnishing help; giving aid; useful.

视频中出现的短语动词

figure out (动词) — 弄清楚. To come to understand; to discover or find a solution; to deduce.

需要注意的发音

说话人用了 8 次缩略和弱读形式，例如 don't, you'll, they've。请按听到的简短形式来说。

“th” 音: enthusiastic /ɪnˌθjuːzɪˈæstɪk/, psychopath /ˈsaɪkəʊpæθ/
“sh” 和 “zh” 音: malicious /məˈlɪʃəs/, compression /kəmˈpɹɛʃ.ən/, dimension /daɪˈmɛn.ʃən/, renovation /ɹɛnəˈveɪʃən/, penetration /pɛ.nəˈtɹeɪ.ʃən/
长单词——注意重音位置: contributor /kənˈtɹɪb.jə.tɚ/, electricity /ɪˌlɛkˈtɹɪsɪti/, intelligent /ɪnˈtɛlɪd͡ʒənt/, unexpected /ʌnɪkˈspɛktɪd/, enthusiastic /ɪnˌθjuːzɪˈæstɪk/

如何用这段视频练习

先完整听一遍视频，不要开口，记下不认识的单词。
先用 0.75 倍速逐句跟读，熟练之后再回到正常速度。
录下自己的声音并与原声对比，特别注意 discover, malicious, server 这类单词。

视频中的语法

说话人最常用的结构，并附上视频中的原话：

结构	视频中的用法
被动语态 be + 过去分词 — 强调发生了什么，而不是谁做的	was shipped · is unaffected · was discovered
现在完成时 have/has + 过去分词 — 过去发生但与现在仍有关联的事	has been · has compromised · have also discovered
定语从句 who / which + 从句 — 补充说明人或事物	LibLZMA, which is · one who can · friend, which is

什么是跟读法？

跟读法 (Shadowing) 是一种有科学依据的语言学习技巧，最初开发用于专业口译员的培训，并由多语言者Alexander Arguelles博士普及。这个方法简单而强大：您在听英语母语原声的同时立即大声重复——就像是一个延迟1-2秒紧跟说话者的影子。与被动听力或语法练习不同，跟读法强迫您的大脑和口腔肌肉同时处理并模仿真实的讲话模式。研究表明它能显着提高发音准确性，语调，节奏，连读，听力理解和口语流利度——使其成为雅思口语备考和真实英语交流最有效的方法之一。

影子跟读法: 阅读完整分步指南 →

跟读练习: Linux got wrecked by backdoor attack - 通过视频学习英语口语

选择练习模式

下载应用

PostgreSQL in 100 Seconds

React Native in 100 Seconds

Every app on Earth is now open source... whether it likes it or not

Brainf**k in 100 Seconds

Mind-bending new programming language for GPUs just dropped...

The plan to break apart Google... RIP Chrome

Docker in 100 Seconds

The worst week in cybersecurity history... so far

The last real programmers are dying out...

Did the AI bubble just pop?

When open-sourcing your code goes wrong...

OpenAI’s new browser feels familiar…

The most interesting "hack" in history...

Tragic mistake... Anthropic leaks Claude’s source code

Firefox and Tor hit with 9.8 critical level exploit

C++ in 100 Seconds

China just dropped a new frontier model... and nobody can explain how

Linux in 100 Seconds

Did Google just dethrone OpenAI and Anthropic?

VS Code in 100 Seconds

There's a new Linux distro in town for developers...

you need to learn HACKING RIGHT NOW!! // CEH (ethical hacking)

So I tried Matt's skills...

STOP Running Code On Your Computer

THIS Is Where the Internet Lives

Did Anthropic Kill Git?

Cicada 3301: An Internet Mystery

Debian Linux GNU Coreutils Situation Is Crazy

Running AI Agents in Secure Sandboxes with E2B & Docker MCP | Docker’s AI Guide to the Galaxy

I Tested The Viral Reverse Engineering Repo

Helpdesk to Sysadmin - 3 Things You Must Learn First