CFSN – A Dangerous Blog

Last night, right after I finished uploading (the first time) my blog post (yes, I know; read on) on the new NTAS Bulletin, I went to look at the post on my blog to get the URL and ran into a BIG RED page that was labeled “Deceptive site ahead”. It went on to say: “Google [Chrome] Safe Browsing recently detected phishing on http://chemical-facility-security-news.blogspot.com. Phishing sites pretend to be other websites to trick you.”

The Problem

Needless to say, I was more than a little concerned. I was afraid that someone had hacked my site. And it is a site that I have little control over beyond posting the content and setting the design. The actual back-end stuff is all run by Google.

I did some checking. I found that my other blog, ‘Future ICS Security News’ was similarly blocked. And so was at least one other blogspot(.)com blog ‘controlled’ by someone not associated with me.

Well, there was a link on the BIG RED page to appeal the designation, so I clicked it, filled out the minimal information requested. In and amongst this searching and appealing I managed to fire off some near-panic tweets, but I finally regained my composure. After reloading my blog post from my Firefox browser (it was not affected by the BIG RED page), I shutdown the computer, did some reading, and went to bed.

I woke up this morning and used Chrome to access my blog site, and everything worked fine. I posted two blog posts without seeing any red. Apparently my appeal worked….

Google Emails

After finishing my lengthy ‘Public ICS Disclosures’ post, I took a break and then checked my emails. There were two interesting missives from ‘Blogger <no reply@google.com>’. The first was sent at 8:06 last night and it read:

Hello,

     As you may know, our Community Guidelines  (https://blogger.com/go/contentpolicy) describe the boundaries for what we  allow-- and don't allow-- on Blogger. Your post titled "New NTAS Bulletin  Published – 5-14-21 " was flagged to us for review. We have determined that   it violates our guidelines and deleted the post, previously at   http://chemical-facility-security-news.blogspot.com/2021/05/new-ntas-bulletin-published-5-14-21_62.html.

     Why was your blog post deleted?

     Your content has violated our Malware and Viruses policy. Please visit our Community Guidelines page linked in this email to learn more.

     We encourage you to review the full content of your blog posts to make sure they are in line with our standards as additional violations could result in termination of your blog.

     For more information, please review the following resources:

     Terms of Service: https://www.blogger.com/go/terms

      Blogger Community Guidelines: https://blogger.com/go/contentpolicy

     Sincerely,

     The Blogger Team

Now, I write my blog in a .DOCX file. There is no software nor any code in my posts. I do have links, in fact I extensively use links, but I have visited every site to which I link and my AV has never warned me about any problems with the sites. On the NTAS post, I only had three links: one to the DHS NTAS site, one to the DHS bulletin (.PDF), and the final post was to an old blog post of mine on the Google controlled site. So, maybe I was hacked…., but the site worked fine this morning.

Now lets look at the second email. It was sent from the same address at 7:15 this morning. It reads:

Hello, 

     We have re-evaluated the post titled "New NTAS Bulletin Published – 5-14-21" against Community Guidelines  https://blogger.com/go/contentpolicy. Upon review, the post has been  reinstated. You may access the post at http://chemical-facility-security-news.blogspot.com/2021/05/new-ntas-bulletin-published-5-14-21_62.html.

     Sincerely,

     The Blogger Team

Actually, they put it back on the site as a draft, but I had already republished it last night from my Firefox bowser. So I deleted the draft before I read the emails this morning.

So, I Still Don’t Understand

If I had two noids, I might think that I had done something to piss Google off. But I really cannot think of a single negative comment, much less a diatribe, I have ever made about Google. I mean, lets be real. My blog is taking up a relatively large chunk of server space and Google is not charging me a dime. Talk about biting the hand that feeds you. And I do not see anything that anyone would object to in that NTAS post.

I just don’t know…

In any case, my apologies to anyone that tried to read my post yesterday via a Chrome browser. I may have some mildly controversial ideas from time to time, but I am not now, nor have I ever been trying to foist off malware or phishing links on my blog. Scout’s honor.