{"id":1574,"date":"2019-03-25T15:01:13","date_gmt":"2019-03-25T14:01:13","guid":{"rendered":"https:\/\/wpethzprd.ethz.ch\/its\/?p=1574"},"modified":"2019-03-25T15:01:15","modified_gmt":"2019-03-25T14:01:15","slug":"christian-hallqvist-celebrates-25-years-with-eth","status":"publish","type":"post","link":"https:\/\/blogs.ethz.ch\/its\/2019\/03\/25\/christian-hallqvist-celebrates-25-years-with-eth\/","title":{"rendered":"Christian Hallqvist celebrates 25 years with ETH"},"content":{"rendered":"\n

Congratulations to Christian Hallqvist, ITS employee with ITS Network Security, ICT Networks<\/p>\n\n\n\n\n\n\n\n

\"\"<\/figure>\n\n\n\n

You can read about\nwhat led up to his 20-year anniversary in the post \u201e20 years with\nETH<\/a><\/strong>\u201c.\nIn the last five years, however, even more has happened \u2013 with some highs and\nlows.<\/p>\n\n\n\n

WannaCry incident<\/strong><\/h2>\n\n\n\n

To get an idea of how\nthings can sometimes go, I\u00e2\u20ac\u2122ll use the example of the WannaCry case from May\n2017. It all started with a phone call on Saturday, 13 May 2017. I was informed\nthat ransomware was making the rounds and the ETH network had to be checked. <\/p>\n\n\n\n

We worked through the weekend \u2013 from morning to night<\/strong><\/h3>\n\n\n\n

Through our\ncollaboration with SWITCH, among other things, we quickly found a secure and\nefficient method of finding suspicious cases. Our source was the local DNS\nlogs. We were also able to monitor outgoing DNS queries through IDS. The method\ngave us practically no false negatives. <\/p>\n\n\n\n

We were lucky to have so many curious and adventurous students at ETH who also followed this wave. Their experiments and tests generated multiple false messages in our logs, known as false positives. <\/p>\n\n\n\n

We did, however, go through every single message.<\/strong><\/h3>\n\n\n\n

Naturally it was easy,\nsince those affected by ransomware need to make very little effort to confirm\nor deny an attack. Anyone who was affected could clearly see whether or not\ntheir device was a victim of ransomware. Loss of data as a result of ransomware\nis clearly visible, for example with the following text: \u201eAll of your data has\nbeen encrypted. Transfer so much money to this Bitcoin account and you will\nreceive the decryption code.\u201c<\/p>\n\n\n\n

We went through each\npotential case one after the other and once the wave had finally subsided we\ndiscovered to our astonishment that our ETH network had not been affected by\nWannaCry at all. There was not a single true positive. <\/p>\n\n\n\n

This exercise taught\nus a lot, and we are unbelievably happy at how resistant our ETH network\nactually is, thanks to well-patched modern systems.<\/p>\n\n\n\n

False positive<\/strong><\/h2>\n\n\n\n

An alarm message that\ndoesn\u00e2\u20ac\u2122t actually mean an alarm:
\nLike, for example, when someone triggers a fire alarm for no reason or out of\nboredom.<\/p>\n\n\n\n

True positive<\/strong><\/h2>\n\n\n\n

An alarm message that\nin reality actually is an alarm:
\nLike, for example, when someone triggers a fire alarm because of a fire. <\/p>\n\n\n\n

False negative<\/strong><\/h2>\n\n\n\n

When no alarm message\nis generated although it clearly should have been:
\nLike, for example, when a fire breaks out and no one reports it. Everyone runs\nfrom the building in panic without sounding the fire alarm.<\/p>\n","protected":false},"excerpt":{"rendered":"

Congratulations to Christian Hallqvist, ITS employee with ITS Network Security, ICT Networks!<\/p>\n","protected":false},"author":44908,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[257891,25],"tags":[261270,173194,260550,260376],"class_list":["post-1574","post","type-post","status-publish","format-standard","hentry","category-it-sec","category-news","tag-25-years-of-eth","tag-anniversary","tag-ransomware","tag-wannacry"],"_links":{"self":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/posts\/1574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/users\/44908"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/comments?post=1574"}],"version-history":[{"count":0,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/posts\/1574\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/media?parent=1574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/categories?post=1574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.ethz.ch\/its\/wp-json\/wp\/v2\/tags?post=1574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}