3

As of a week or so ago I started receiving what appears to be spam gnome notifications shortly after logging in (within a few minutes but not necessarily immediately). They always appear to be from a site called alison.com. I see nothing relevant in my Ubuntu Settings -> Notifcations specific to this, nor anything in my syslog @ /var/log/syslog. This is the first time I've ever seen anything resembling spamware on Ubuntu so curious if others have seen similar things.

So my core question is how to get rid of these. As a first step though, is there a log somewhere that tracks gnome notifications or someway I can filter another log to see such information? I'd like to track down where these are coming from such that I can stop their source.

Edit:

Adding release info as requested in comments:

  • Ubuntu 20.04.3 LTS
  • GNOME Version 3.36.8
  • Windowing System X11

And adding info about lack of screenshots. The notifications pop up and disappear in a matter of seconds so capturing a screenshot has proven to be quite difficult. I will continue to try and update if I succeed.

Edit 2

I found in the Firefox notification settings that alison.com has allow notification permissions. I suppose it is possible I inadvertantly did this as some point, but I honestly don't remember even visiting this site ever. Is there a way of verifying how/when this permission was set or some other way of proving to myself that this was an accident caused by myself and not some ongoing spamware lurking in the shadows?

topher217
  • 1,377
  • 1
  • 9
  • 12
  • 1
    Providing a release is always helpful (as we know some details as to what software stack you're running), as well as specific details as to server/desktop/core install (you mention GNOME so it's likely a desktop install for *unstated* release). I'd check your browser addons; but currently you've provided no example (picture; text) for an *unstated* Ubuntu product and *unstated* release so we'd only be guessing as we've been provided with few specifics. FYI: browsers running as *snap* packages tend to be harder to infect, but if with bad extensions added; are generally easier to clean.. – guiverc Feb 21 '22 at 00:52
  • 5
    This may be coming through your browser, possibly via an extension. If you're using Chrome (or something built from it), then [this answer](https://askubuntu.com/a/1067618/1222991) may help. – matigo Feb 21 '22 at 01:09
  • Check what notifications are allowed in Chrome. – Organic Marble Feb 21 '22 at 01:24
  • Edit your question and include a clearer description of what you are experiencing. A screenshot would be helpful, or include the entire text of the notification. – Nmath Feb 21 '22 at 01:51
  • 1
    In Firefox/Chrome, review the saved cookies, and search for "alison", and delete those cookies. – heynnema Feb 21 '22 at 03:45
  • I added release info and a bit more context as well as reasoning why I have no screenshots (yet). I found several items in the firefox history for alison, and none for firefox, so guessing these are coming via firefox based on what I'm reading here. I've found and cleared the cookies from alison.com, but it is still not clear to me how these notifications can be generated via firefox. Shouldn't any gnome notification leave a log/trace somewhere? I can clear cookies and whatnot, but I'd like to be sure the root cause is gone via tracking it back to the source. – topher217 Feb 21 '22 at 04:50
  • You visited some web site that dropped the cookies into your system. The cookie gives permission for that web site to push notifications. If you've removed the cookies as per my instructions, you've probably taken care of the problem. – heynnema Feb 21 '22 at 13:53
  • The answer at https://askubuntu.com/q/1084681/274825 is related at least for Firefox users – Neil Robertson Aug 15 '22 at 00:06

1 Answers1

1

From the comments...

In Firefox/Chrome, review the saved cookies, and search for "alison", and delete those cookies.

You visited some web site that dropped the cookies into your system. The cookie gives permission for that web site to push notifications. If you've removed the cookies as per my instructions, you've probably taken care of the problem.

I've found and cleared the cookies from alison.com.

I found in the Firefox notification settings that alison.com has allow notification permissions.

heynnema
  • 68,647
  • 15
  • 124
  • 180
  • I was unaware cookies could give such permissions. Could you provide some example or reference to see how this works? – topher217 Feb 22 '22 at 06:47
  • @topher217 You'll have to Google it for more information. I'm not exactly sure how it all happens. There are preferences in Firefox that can limit/reject cookies. – heynnema Feb 22 '22 at 09:33