AliExpress' hidden audio tracking code uncovered
Bluetooth headphone issue reveals covert browser fingerprinting system
1Surprising cause of headphone issue
A developer investigating why his Bluetooth headphones kept cutting out discovered hidden code on AliExpress' homepage. Audio from his phone stopped shortly after the page loaded, with the issue resolving immediately when closing the tab. Despite no visible media elements on the page, the developer determined the site was secretly processing audio through browser APIs.
2Covert audio processing system
Research revealed AliExpress' homepage creates two AudioContext objects that build an audio processing graph without any visible media. Two scripts named collina.js and fireyejs.js were identified as part of Alibaba's browser security and anti-abuse tools. These scripts create an audio graph with zero gain, triggering browser audio processing without producing audible sound.
3Comprehensive fingerprinting
The system collects extensive device fingerprints including hardware specs, browser capabilities, and user interactions. Data points range from screen dimensions and hardware concurrency to installed plugins and media format support. Collected data gets encrypted and sent to Alibaba telemetry services, enabling unique user identification across sessions.
4Browser defense strategies
Firefox neutralized this fingerprinting method in 2023 by making WebAudio output constant, with 99% of users now returning one of three values. Brave injects random data to show different fingerprints to different sites. Safari adds errors to audio buffers for protection. Chrome remains less aggressive against fingerprinting techniques despite growing privacy concerns.
5Security vs privacy balance
The discovered scripts are reportedly linked to anti-fraud systems. Blocking them may trigger additional CAPTCHAs or checkout issues. Cloudflare is collaborating with major browsers on new anti-bot protocols to distinguish humans from automated traffic. These developments highlight the ongoing tension between online security measures and user privacy rights.
6Temporary user solution
The developer successfully blocked the problematic scripts using uBlock Origin filter rules. However, existing tabs must be closed as script blocking doesn't terminate already-created audio contexts. This workaround allows normal page rendering while stopping covert audio processing. Privacy-conscious users can employ similar ad blockers for protection.
7Industry-wide challenge
Experts note at least 30 distinct fingerprinting techniques currently work in Chrome, deployed across millions of websites. Google's plan to disable Manifest V2 extensions may impact popular ad blockers. Browser fingerprinting remains valuable for advertisers and fraud prevention, creating an ongoing cat-and-mouse game between trackers and privacy advocates.
8Future of digital privacy
This discovery demonstrates how sophisticated online tracking has become. Systems collecting user data without awareness raise significant privacy concerns. The battle between browser makers and tech giants will shape the internet's future. Consumer awareness and preference for privacy-focused browsers are becoming increasingly important in this evolving landscape.
Original article: The Next Web — AliExpress'in gizli ses izleme kodu keşfedildi