AliExpress caught fingerprinting browsers with inaudible sound
Chinese retailer AliExpress has been identified fingerprinting browser users via an inaudible audio technique, which interfered with a researcher's headphones.
Chinese e-commerce giant AliExpress has been caught employing a technique to uniquely identify website visitors by using inaudible sound signals. The method, which analyzes browser audio capabilities, came to light when it disrupted researcher Matthew Callaghan's Bluetooth headphones.
Callaghan discovered the tracking mechanism accidentally. When loading the AliExpress homepage, audio playback on his multi-device headphones unexpectedly stopped. The audio resumed only after he closed the tab containing the site. This led him to investigate the unusual behavior.
Further analysis revealed two highly obfuscated scripts on the site. These scripts generated an oscillator that measured the WebAudio readings of each browser, analyzing sawtooth waves characteristic of digital audio output. While imperceptible to human users, these measurements can create a unique digital fingerprint for a browser.
This method, described as an outdated technique, allows for user tracking without relying on traditional cookies. The incident highlights ongoing efforts to develop sophisticated online tracking methods and underscores the importance of transparency and user privacy in digital environments.