Chinese retailer AliExpress has been caught fingerprinting visitors after one of the metrics—an outdated technique that measures inaudible sounds it sends to browsers—impeded a researcher’s ability to use his bluetooth headphones.
Researcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time. He set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible.
While investigating the odd behavior, Callaghan said he found two highly obfuscated scripts. Together, they rendered a graph that analyzed the WebAudio readings of each visiting browser. This graph acted as an oscillator that measured Sawtooth waves, which are common in output from digital audio.
“The oscillator generates a known waveform,” Callaghan wrote. “The analyser measures the result after it has passed through the browser’s audio implementation, and the script reads frequency data from it.”
The scripts set the gain to zero to prevent users from hearing anything. But because the graph is still connected to the selected system audio, the browser continues to process it and, eventually, sends it to AliExpress.
Variability in different math libraries, which are used when audio is produced through browsers, were once high enough to provide a massively large number of uniquely different signatures when combined with different CPUs and other system differences. After the audio soundprinting technique became well known, Firefox implemented a fix, starting in version 118 released in 2023. Beginning then, the browser used its own unique math libraries, rather than relying on ones that shipped with the OS it ran on. Tom Ritter, a Firefox developer who has also volunteered for the Tor Project, said the move to constant libraries reduced the entropy enough to stop the technique from working.
The technique is ineffective in Chrome because it, too, ships with its own libraries, a Google spokesperson said. Safari users are likely safe for the same reason, although Apple didn’t immediately confirm that.
AliExpress’ use of an obsolete fingerprinting method raises the question: Why is it bothering to use it? The likely answer has to do with the more than a dozen other fingerprinting methods the online retailer is using. Callaghan said the other techniques included: canvas rendering and toDataURL(); WebGL renderer information, extensions, and shader precision; audio oscillator and analyzer output; screen and viewport dimensions; device pixel ratio; hardware concurrency and device memory; installed browser plugins; supported audio and video formats; WebRTC behavior; browser performance timing; mouse, touch, focus, and scroll events; device motion and orientation; properties commonly associated with browser automation.
It’s likely the web audio trick is left over from years earlier and no one noticed it until now. It’s comforting to know that browser makers have taken precautions. At the same time, it’s not yet clear how effective the rest of the metrics AliExpress is using are. Less reassuring still: it’s almost a certainty that thousands of sites are employing similar tracking. Browser developers are in a dynamic race with site publishers, who are constantly looking for new ways to break the latest protections.
