google

Google Search and Drive are erroneously flagging links to Association for Computing Machinery (ACM) research papers and websites as malware.

BleepingComputer has successfully reproduced the issue, first reported by researcher Maximilian Golla.

Founded in 1947 and headquartered in NYC as a non-profit, The Association for Computing Machinery (ACM) is the world's largest scientific and educational computing society. As of 2019, ACM's membership comprises nearly 100,000 students and professionals involved in the field of computing.

Research paper "violates" Google Drive policies

Germany-based PhD researcher, Maximilian Golla of Max Planck Society was frustrated on seeing one of his Google Docs files restricted by Google.

The file, according to Golla, contained links to ACM research papers, but "violates" Google's Terms of Service as per a screenshot shared by the researcher:

TWEET
Researcher's Google Docs file flagged for containing ACM links (Twitter)

And, it's not just Google Drive. Google Search is acting funny too, Golla points out.

BleepingComputer confirmed Google Search results for the ACM website, ACM Digital Library research papers, and contact pages are also treating links to ACM domains as malicious.

Google search results flag ACM domains as malicious
Google search results flag ACM sites as malicious (BleepingComputer)

In our tests, clicking on any of the acm.org, dl.acm.org or libraries.acm.org links appearing in the results led to an "interstitial" hosted on Google's redirection page, warning visitors that the link might be harmful.

This issue is essentially blocking any and all traffic to ACM domains from Google Search results. ACM visitors will instead have to manually copy-paste the intended link in their web browser's address bar:

Google interstitial
Google search results to ACM site blocked by an interstitial (BleepingComputer)

These warnings are typically shown by Google to visitors who may inadvertently be navigating to compromised sites or domains hosting adware, MageCart scripts, or other types of malware. Thus far, there is no indication that ACM's domains are compromised or serving malware. BleepingComputer has reached out to ACM to ensure that is indeed the case.

"For detailed information about the problems that we found, visit Google's Safe Browsing diagnostic page for this site," advises Google's warning message. But, BleepingComputer observed the "diagnostic page" indicated that ACM's website was safe:

google diagnostic page for ACM
Google's SafeBrowsing Diagnostic page states ACM is safe (BleepingComputer)

Third time's a charm

Although the blocking of ACM links across Google Search and Drive seems erratic, this isn't the first time Google Drive has erroneously flagged materials for being in violation of its Terms of Service when there is none.

In January, Google Drive was seen restricting nearly empty files for 'copyright infringement'. These files contained no data other than some numbers or a single digit, such as '1'.

Google Drive documents that contain phishing links, even for personal research purposes have, on occasion, also been automatically marked to be in violation of terms and had their sharing features restricted.

BleepingComputer reached out to Google prior to publishing to understand what is causing the issue with ACM domains. While Google did not immediately disclose the cause of the problem, by Thursday evening, ACM purportedly made changes to its website resolving the issue:

"With ACM taking down the portion of their site that triggered our malware distribution warnings, this has now been resolved," a Google spokesperson told BleepingComputer.

BleepingComputer has still not heard back from ACM.

Update, July 22, 02:43 AM ET: Added statement from Google received hours after publishing.

Related Articles:

New Brokewell malware takes over Android devices, steals data

Fake job interviews target developers with new Python backdoor

Researchers sinkhole PlugX malware server with 2.5 million unique IPs

Google Meet opens client-side encrypted calls to non Google users

CoralRaider attacks use CDN cache to push info-stealer malware