AliExpress Caught Using Hidden Audio Tracking to Collect User Data
Translated & summarized from Maariv by baba
AliExpress allegedly used hidden scripts exploiting the Web Audio API to track users by creating unique device fingerprints without consent. The tracking was uncovered after a Bluetooth issue led a user to investigate the site’s code. Browsers like Brave and Firefox offer protections against such audio-based tracking methods.
The story in 5 lines · by baba
- AliExpress used hidden scripts to track users by creating unique device fingerprints via inaudible audio signals.
- The tracking exploited the Web Audio API to measure how devices processed silent sounds, collecting hardware data.
- A Bluetooth earphone issue led a user to discover two covert scripts maintaining an open audio channel.
- Brave and Firefox browsers have built-in protections against this type of audio fingerprinting.
- Ad blockers like uBlock Origin can block these scripts but may affect site performance.
A recent Bluetooth earphone malfunction revealed a covert tracking mechanism allegedly used by the AliExpress website. The site reportedly created a unique "fingerprint" of users' devices by collecting hardware and behavioral data without their knowledge or consent. This discovery came after a user noticed inconsistencies while trying to connect Bluetooth devices and investigated the website's code, uncovering two hidden scripts named collina.js and fireyejs.js. These scripts kept the computer's audio channel open, preventing Bluetooth switching despite no sound playing.
The tracking method exploited the Web Audio API, a browser tool intended for legitimate audio processing, to emit inaudible sounds at zero volume. Instead of producing noise, the scripts measured how each device processed the silent audio signal. Since every computer processes sound slightly differently due to variations in processors, sound cards, and other hardware and software components, this subtle inconsistency served as a unique device fingerprint.
In response to the revelation, the Brave browser team stated that their software has protected users from such audio-based fingerprinting techniques by default for over six years, injecting random data to confuse trackers. Mozilla Firefox also includes protections against audio feature-based tracking. For browsers lacking built-in safeguards, ad and content blockers like uBlock Origin can block these specific scripts, though this may sometimes disrupt website functionality.
The same event, reported separately by each outlet. Open a few to compare what different newsrooms emphasize — and what they leave out.
Centre 2
