A researcher identified that AliExpress employs an obsolete browser fingerprinting method that generates and analyzes inaudible sounds to identify and track site visitors. The discovery occurred when the technique inadvertently disrupted the functionality of the researcher’s multipoint Bluetooth headphones, which became inaudible each time the AliExpress homepage loaded.
The mechanism involves two obfuscated scripts that create an audio graph using the WebAudio API. The system generates a known waveform pattern through an oscillator and measures how it processes through the browser’s audio implementation. By setting the gain to zero, the scripts prevent users from hearing the sound while the browser continues to process the audio signal, ultimately transmitting the analysis data to AliExpress.
This fingerprinting approach relied on variability in different math libraries used for audio processing across browsers and systems to create unique signatures. However, browser developers have since implemented protections against this technique. Firefox addressed the vulnerability starting in version 118 released in 2023 by employing its own standardized math libraries rather than relying on operating system libraries. Chrome similarly uses its own built-in libraries, making the technique ineffective on that browser. Safari is presumed to have implemented comparable safeguards.
The use of this outdated method by AliExpress appears connected to its deployment of more than a dozen other fingerprinting techniques. Security researchers suggest the audio soundprinting may be legacy code from earlier implementation periods that went unnoticed. While browser manufacturers have taken protective measures, ongoing concerns remain about the effectiveness of AliExpress’s remaining tracking methods and the likelihood that thousands of other websites employ comparable tracking mechanisms. The situation reflects a continuing competition between browser developers and website operators seeking to circumvent tracking protections.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI