Chinese retailer AliExpress has been found using an “audio trick” that can fingerprint visitors by analysing sounds processed by their web browsers. The technique measures inaudible audio signals and was discovered by researcher Matthew Callaghan after visiting the AliExpress website repeatedly caused his phone audio to stop playing through his Bluetooth headphones.According to a report by Ars Technica, Callaghan said the problem occurred because his headphones support multipoint connections, allowing them to connect to his phone and PC at the same time. He had configured them to play audio from his phone unless his PC was producing sound. Each time he opened AliExpress, the phone audio stopped, and it resumed after he closed the tab containing the website.
How AliExpress used browser audio fingerprinting
While investigating the issue, Callaghan found two highly obfuscated scripts on the AliExpress homepage. Together, the scripts generated a graph that analysed WebAudio readings from the browser.The system used an oscillator to generate Sawtooth waves, a type of waveform commonly produced by digital audio systems. An analyser then measured the resulting frequency data after the signal passed through the browser’s audio implementation.“The oscillator generates a known waveform,” Callaghan wrote. “The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it.”The scripts set the audio gain to zero, meaning the visitor could not hear the signal. The audio graph remained connected to the selected system audio, however, allowing the browser to process the signal before sending the resulting information to AliExpress.The technique can be used for audio fingerprinting because differences in the way browsers and systems process audio can produce identifiable results. Those differences were once large enough to create many distinct signatures when combined with variations in CPUs and other system characteristics.
Firefox and Chrome have protections against audio fingerprinting
Firefox addressed the technique beginning with version 118, released in 2023. The browser began using its own consistent math libraries rather than relying on operating-system-supplied libraries.Tom Ritter, a Firefox developer who has also volunteered for the Tor Project, said the change reduced the amount of identifying information available from the technique enough to prevent it from working.The technique is also ineffective in Chrome because Google’s browser uses its own libraries, according to a Google spokesperson. Safari users are likely protected for the same reason, although Apple did not immediately confirm this.
AliExpress uses multiple browser tracking methods
The audio technique is only one of several metrics Callaghan identified in AliExpress’ tracking scripts. The other methods he found included:* Canvas rendering and `toDataURL()`* WebGL renderer information, extensions and shader precision* Audio oscillator and analyzer output* Screen and viewport dimensions* Device pixel ratio* Hardware concurrency and device memory* Installed browser plugins* Supported audio and video formats* WebRTC behavior* Browser performance timing* Mouse, touch, focus and scroll events* Device motion and orientation* Properties commonly associated with browser automationTogether, these measurements can provide information about a visitor’s browser and device. Callaghan said the WebAudio method appears to be an older fingerprinting technique that may have remained in AliExpress’ code despite browser changes that have reduced its effectiveness.