AliExpress Caught Using Inaudible Audio to Track Web Browsers

E-commerce giant AliExpress was caught stealthily fingerprinting web browser visitors using inaudible sounds after the tracking script accidentally interfered with a cybersecurity researcher's Bluetooth headphones.

Security researcher Matthew Callaghan discovered the hidden tracking mechanism by accident when his multipoint Bluetooth headphones repeatedly cut off phone audio whenever he loaded the AliExpress homepage on his computer.

Investigating the interference revealed two heavily obfuscated scripts on the retailer's site. The scripts generated an audio graph to analyze the WebAudio readings of visiting browsers, measuring digital frequency data from sawtooth waveforms.

"The oscillator generates a known waveform," Callaghan wrote. "The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it."

The scripts set the audio gain to zero so users could not hear anything. However, because the system audio remained connected, the browser processed the signal and transmitted the unique audio signature back to AliExpress.

Major web browsers have already muted the effectiveness of audio fingerprinting. Firefox reduced mathematical variation across operating systems in 2023, while Google Chrome and Apple Safari ship with standardized audio libraries that block the technique.

The obsolete WebAudio trick is just one of more than a dozen fingerprinting mechanisms used by AliExpress. The site continues to collect data on canvas rendering, WebGL performance, screen dimensions, hardware specifications, touch events, and browser automation properties.