AliExpress Ran Silent Browser Audio to Fingerprint and Track Devices, Researchers Find
An Anonymous Coward writes:
AliExpress has been found to run silent audio processes in the browser to fingerprint and track devices. Code on the homepage, linked to Alibaba's security systems, uses the Web Audio API to send a signal through a device's audio hardware and measure the small, device-specific differences in how it returns.
This creates a fingerprint that does not rely on cookies. The issue only came to light after a developer noticed problems using multipoint Bluetooth headphones while an AliExpress tab was open.
This type of fingerprinting is not something most users would notice.
The issue came to light when a developer's multipoint Bluetooth headphones would not switch properly from a computer to a phone while an AliExpress tab was open. Once the tab was closed, the problem disappeared.
Looking at the site's code, the developer found it used the Web Audio API to build audio-processing graphs set to zero volume. There was no audible sound, but the process still connected to the computer's audio system and kept the audio path active in the background.
This seems to be what interfered with the headphones' ability to switch devices. Since the processing graph ran at zero gain and connected directly to the system's audio output, muting the browser tab had no effect.
The same code can be used for browser fingerprinting, which collects device-specific details to recognize a browser over time. Here, the scripts measured small differences in how a device processed the same audio signal. These differences depend on the computer's processor, sound hardware, operating system, browser, and drivers.
Read more of this story at SoylentNews.