Researcher Matthew Callaghan discovered that AliExpress was employing a browser fingerprinting technique based on inaudible audio signals. The researcher identified the method accidentally after noticing his Bluetooth headphones would disconnect from his phone each time he visited the AliExpress homepage. When he closed the browser tab, the audio connection would resume normally.
Investigating the issue, Callaghan located two heavily obfuscated scripts that generated an audio waveform and analyzed how the browser’s WebAudio implementation processed the signal. The technique worked by setting audio gain to zero, making the sounds inaudible to users while still allowing the browser to process the data and transmit it to AliExpress. The fingerprinting relied on variations in mathematical libraries used for audio processing across different systems and processors, creating unique signatures for each browser.
However, the fingerprinting method has become largely ineffective in modern browsers. Firefox implemented protections beginning in version 118 released in 2023, switching to its own standardized math libraries rather than relying on operating system libraries. Chrome similarly ships with its own libraries, making the technique ineffective for that browser. Apple’s Safari likely offers similar protection, though the company did not immediately confirm this detail.
The discovery raises questions about why AliExpress continues using an obsolete technique when modern defenses have significantly reduced its effectiveness. Security researchers suggest the audio fingerprinting code may be remnants from earlier implementation that went unnoticed. More concerning is evidence that AliExpress employs over a dozen additional fingerprinting methods simultaneously. The finding highlights broader challenges in browser security, as site operators continually seek new tracking approaches while browser developers work to implement countermeasures in an ongoing technological race.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI