A researcher discovered that AliExpress was utilizing an inaudible sound fingerprinting technique after experiencing disruptions to his Bluetooth headphone connectivity. When loading the AliExpress homepage, audio from his phone ceased playing through multipoint headphones that connect to multiple devices simultaneously. The interference stopped each time he closed the browser tab containing the site, prompting an investigation into the cause.
Upon examination, the researcher uncovered two heavily obfuscated scripts that created a graph analyzing WebAudio data from visiting browsers. The system generated a known waveform using an oscillator designed to measure Sawtooth waves, which are typical outputs from digital audio processing. The gain was set to zero to prevent audible sound, yet the browser continued processing the audio signal and transmitted the resulting data to AliExpress.
This fingerprinting approach was once effective because variations in mathematical libraries used for browser audio processing, combined with different CPUs and system configurations, created uniquely identifiable signatures. However, Firefox addressed this vulnerability starting with version 118 released in 2023, implementing its own standardized mathematical libraries instead of relying on operating system-level libraries. Chrome similarly ships with proprietary libraries, rendering the technique ineffective there, and Safari likely offers similar protection.
AliExpress’ continued use of this obsolete fingerprinting method appears puzzling given its ineffectiveness in modern browsers. The likely explanation involves the dozen or more additional fingerprinting techniques the retailer simultaneously employs, suggesting the audio method may be legacy code that escaped notice. Browser developers and website operators continue engaging in an ongoing competition, with publishers constantly developing new tracking methods while browser makers implement protective measures to counter them.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI