Security
AliExpress secretly fingerprints browsers with inaudible audio signals
A researcher uncovered a hidden tracking scheme when invisible sound waves disrupted his multipoint Bluetooth headphones.
Ars Technica
AliExpress has been identified using a covert tracking technique that sends imperceptible audio signals to visitors' browsers in order to harvest device fingerprints. The discovery came about when researcher Matthew Callaghan noticed an unusual side effect: his Bluetooth headphones kept cutting off audio from his phone whenever he visited the Chinese e-commerce site.
How the scheme works#
Callaghan's investigation revealed two heavily obfuscated pieces of code working together to execute the fingerprinting operation. The scripts leverage WebAudio APIs to generate a mathematical waveform—specifically a Sawtooth wave—that travels through the browser's audio system without being amplified for human hearing.
Here's the mechanics:
- An oscillator creates a known digital waveform pattern
- The audio analyser measures the waveform as it passes through the browser's audio layer
- The script extracts frequency data and transmits it back to AliExpress
- The gain is set to zero, making the signal inaudible to humans
Because the waveform remains connected to the system's audio output chain even at zero volume, browsers continue processing and relaying the data—creating a unique fingerprint of each visitor's audio hardware and software.
Why it interfered with Bluetooth#
Callaghan's multipoint headphones accept simultaneous connections from multiple devices. When the inaudible audio stream began playing through his PC's audio system while connected to the headphones, the device would automatically switch audio focus away from his phone—each time he loaded AliExpress, the phone's audio would pause. Closing the tab restored normal playback, revealing the culprit.
The tracking angle#
This fingerprinting technique falls into a category of methods that attempt to establish a stable, persistent identifier for individual users without their knowledge or consent. By capturing audio hardware characteristics, the site can recognize returning visitors even when cookies are cleared or incognito browsing is used.
