A researcher identified that AliExpress employs an inaudible sound fingerprinting method to track browsers after noticing his Bluetooth headphones disconnected each time he visited the site. The technique works by sending imperceptible audio signals through a browser’s WebAudio API, analyzing how different system components process the sound to create a unique fingerprint for identification purposes.
The researcher found two obfuscated scripts working in tandem to execute the tracking. One script generates a sawtooth waveform at zero gain to prevent audible output, while the other measures how the browser’s audio system processes this signal. The resulting frequency data collected from these measurements is transmitted back to AliExpress. While inaudible to users, the technique produces measurable differences across devices due to variations in system audio libraries and hardware configurations.
The fingerprinting approach has become largely ineffective in modern browsers due to defensive updates. Firefox implemented protections starting in version 118 released in 2023, switching to uniform math libraries rather than relying on operating system-specific ones. Chrome similarly ships with its own libraries, rendering the technique ineffective for users of that browser. Safari likely provides comparable protection, though Apple has not officially confirmed this.
AliExpress appears to have retained this obsolete tracking method alongside more than a dozen other fingerprinting techniques simultaneously deployed on its platform. Security researchers suggest the audio-based approach may be legacy code from earlier periods that escaped notice during updates. The discovery underscores ongoing tensions between browser developers implementing privacy protections and websites continuously seeking alternative tracking mechanisms to circumvent these safeguards.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI