AliExpress Uses Silent Audio Signals to Track Users via Device Fingerprinting

A software developer known as laserphile recently discovered that AliExpress, the Chinese e-commerce giant owned by Alibaba, employs a sophisticated tracking method using silent audio signals. When he opened the AliExpress website on his computer, music playing through his Bluetooth headphones connected to his phone would pause, resuming only after closing the site. His headphones supported Multipoint technology, allowing simultaneous connection to two devices, but the site caused the computer to seize the audio channel despite no audible media playing.

Investigating the site’s code, laserphile found that AliExpress uses the WebAudio API to emit an inaudible sound signal at zero volume. The site then analyzes how the computer processes this sound, exploiting subtle differences in audio processing caused by variations in browser versions, operating systems, hardware components, and audio libraries. This technique is part of digital fingerprinting, which creates a unique device profile without relying on cookies or recording user audio.

Beyond audio fingerprinting, AliExpress also collects data from other browser and hardware features such as Canvas, WebGL, screen dimensions, WebRTC, mouse movements, and touch events. These combined data points help build a detailed profile of the user’s device, which is sent back to Alibaba’s telemetry servers. This profiling can identify devices uniquely enough to track users across sessions.

The likely motivations for AliExpress and Alibaba to use such tracking include combating fake accounts, fraud, and coupon abuse on their massive online marketplace, as well as gathering valuable marketing data. The discovery was triggered by a minor Bluetooth headphone glitch, revealing a complex and largely invisible tracking system operating behind the scenes without user consent or awareness.

Summary: A developer uncovered that AliExpress uses inaudible audio signals combined with other browser data to fingerprint and track users’ devices, sending detailed profiles to Alibaba’s servers. This method helps the platform prevent fraud and gather marketing intelligence, revealed after a Bluetooth headphone malfunction paused music playback when visiting the site.

Points: - AliExpress uses silent audio signals via WebAudio API to fingerprint users’ devices. - The site analyzes subtle audio processing differences unique to each device. - Additional data from Canvas, WebGL, screen size, and user interactions enhance tracking. - Collected device profiles are sent to Alibaba’s telemetry servers. - Tracking helps prevent fraud and supports marketing on the platform. - A Bluetooth headphone glitch exposed this hidden tracking method.

Topic: tech israel_relevant: false Entities: {"people": ["laserphile"], "organizations": ["AliExpress", "Alibaba"], "places": []}