Researcher Matthew Callaghan discovered that AliExpress was employing an inaudible audio fingerprinting technique after experiencing disruptions to his Bluetooth headphone connectivity. Each time he visited the AliExpress homepage, audio from his phone stopped playing through his multipoint headphones, and the issue resolved when he closed the browser tab. Upon investigation, Callaghan identified two heavily obfuscated scripts that worked together to analyze WebAudio readings from visiting browsers.
The scripts functioned by generating a known waveform through an oscillator that measured Sawtooth waves commonly produced by digital audio systems. The technique set audio gain to zero to make the process inaudible to users, but because the audio graph remained connected to the system’s audio output, browsers continued processing and transmitting the data to AliExpress. The method relied on variations between different mathematical libraries used in audio processing across browsers and operating systems to create unique browser signatures.
Browser developers have substantially reduced the effectiveness of this technique. Firefox implemented protective measures starting with version 118 in 2023 by using its own standardized mathematical libraries rather than relying on operating system libraries, thereby reducing the entropy needed for reliable fingerprinting. Chrome similarly ships with its own libraries, making the technique ineffective in that browser. Safari likely offers comparable protection, though Apple did not provide immediate confirmation.
The discovery raises questions about why AliExpress continues using an obsolete tracking method when more contemporary fingerprinting approaches are available. Callaghan identified over a dozen other fingerprinting metrics being deployed by the retailer, suggesting the audio technique may be legacy code that has not been removed. Security researchers note that thousands of websites likely employ similar tracking methods, and browser developers continue engaging in a competitive cycle with site publishers seeking to circumvent the latest privacy protections.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI