Thread by @Laughing_Mantis

12 years ago my life was saved by Hurricane Sandy when I was supposed to be in a building performing incident response that got blown up.

There are not many public stories of physically targeted incidents directly related to cybersecurity but they exist.

This is the story

In August of 2012, Kaspersky and Symantec both discovered a relatively new malware named W32.DistTrack this would later be infamously known as Shamoon Wiper.

It's now public that Shamoon hit several middle eastern companies including Saudi Aramco.

I was on the original IR team

As now disclosed by others who were on the team, the attack probably originated by targeting IT workers and was planned for months. The delivery mechanism was advanced and targeted specifically for each target.

In October of 2012 I was asked to go to Saudi Arabia to do IR

My expired passport recently expired and I didn't have shots for Saudi (Always always get your shots, I had a friend who died from meningitis because he didn't get a shot going over seas)

A $600 bill from passport health and an overnight passport renewal at DC in was set to go

We got an email to coordinate and meet at a tractor showroom because likely the customer didn't want large groups of various experts coming in and appearing like a crisis was happening at their main facility, keep in mind none of this was public at the time.

I was in DC when hurricane Sandy hit, if you were as well you know how bad it was, the airport flooded, the highway between Baltimore and DC was inaccessible. My flight from late Oct 30th to land and to be on site was cancelled.

I stayed in DC to take the next available flight

October 31st just after 11 pm I had my security officer call me frantically

My security officer was one of my fave people, during his time in intelligence, he was at the Berlin Wall when it fell - he had the best stories.

SO: "Greg, you answered, holy shit, are you safe, do you need an extraction"

Me: "Hey, I'm ok, the hurricane wasn't that bad."

SO: "Wtaf are you talking about? Are you ok from the explosion?"

Me: ???

SO: where are you?

Me: my flight got cancelled I'm still stateside

When I managed to get back to our office (took a whole day because the highway was screwed)

So my SO greets me and has me sit in the office, and tells me about the situation

So roughly at 7:10 am Riyadh time a fuel truck blew past 2 security barriers and hit a overpass

The overpass was right next the Zahid tractor showroom which was exactly where we chose to coordinate that morning at 7 am.

This explosion flattened the entire building, 120+ injured, 25+ dead

Many of them the people I was scheduled to interface with

Here if the aftermath

Of course no terrorism exists in the great country of Saudi Arabia, so we were assured this was an isolated accident.

My SO investigation came to other conclusions, particularly with the air to fuel ratio of the truck involved IYKYK.

I will leave it up to the reader to draw to conclusions as who or why this incident happened but from our investigations it was likely an attempt against future capabilities.

Regardless these happen, we don't talk about them openly but they happen (research MITRE incident)

Sadly Twitter killed half of this thread but I will say that as cyber becomes more and more pivotal to critical components - the more we will see the crossover of physical events directly impacting the livelihood of people in cybersecurity