AliExpress suspected of hiding device audio tracking through browser

AliExpress allegedly uses hidden audio tracking, which allows you to collect unique device characteristics directly through your browser. To do this, the site runs audio processing without a sound signal, and the data generated can be used along with other parameters to form a digital fingerprint of the device.

Photo credit: Pawel Czerwinski/Unsplash

According to reports, the investigation reasons Technical pointsa developer noticed a problem with the Bluetooth headset while using AliExpress. The headset does not switch correctly from computer to smartphone when the website tab is open, but the problem disappears after closing the page. After examining AliExpress’s source code, the developers discovered that the site uses the Web Audio API to create audio recordings that run at zero volume. Although the user cannot hear the sound, the browser continues to process the audio signal and connect to the computer’s audio system, which apparently affects the operation of the Bluetooth headset.

However, the detected activity is not related to normal multimedia playback. Since the audiologger operates at zero gain and is connected directly to the system audio output, simply muting the browser audio of a tag is not sufficient to stop signal processing. Additionally, the same mechanism can be used for audio fingerprinting, a technique that identifies devices based on subtle differences in the processing of the same audio signal. The result is affected by the processor, audio hardware, operating system, browser, and drivers, so the combination of these characteristics results in a stable device identifier.

According to the code found, audio data is just one piece of information that the AliExpress script can collect. They also include information related to Canvas rendering, WebGL, display settings, hardware configuration, WebRTC operations, and user operations. Parameter combinations allow you to create more detailed device profiles than using any one feature.

Online services widely use fingerprinting to prevent fraud, detect bots and assess suspicious activity, but the problem is that users may be unaware of the collection of such data and have little control over it.

Bravery also draws attention to what is happening. On August 22, the company reported on social network TechSpot points out that owners of other browsers can also use content filtering tools (such as the uBlock Origin extension) to block these scripts, but this may affect the operation of certain AliExpress features.