Silent Audio Fingerprinting on AliExpress: Security Implications

Recently, I stumbled upon a revelation about AliExpress using silent audio fingerprinting. This discovery came from Matt Callaghan, a developer who found this while working through Bluetooth multipoint connection problems. Turns out, the AliExpress homepage was doing something sneaky—it was running audio stream operations without any sound you could hear. This was hooked into a larger tracking system within the AWSC anti-bot suite, using scripts like collina.js and fireyejs.js.

What Happened?

Callaghan's headphones wouldn't switch audio from his desktop browser to his phone. He dug in and uncovered that AliExpress was keeping an audio stream open, even though it wasn't making any sound. The tracking scripts took advantage of the Web Audio API to fingerprint devices, depending on hardware-related execution details. Essentially, these scripts set up a synthetic audio processing graph to capture tiny numerical differences unique to each user's hardware and software setup.

How Does Audio Fingerprinting Work?

So, what exactly is happening here? Audio fingerprinting involves running a known waveform through a series of mathematical operations. These are handled by the browser's digital signal processing routines, which differ depending on your system's hardware and software. The end result? A frequency output that's unique to each device, letting the site track users quietly. This process works because digital signal processing routines operate across different floating-point units (FPUs), instruction sets (like AVX or ARM NEON), OS mixing engines, and vendor drivers, creating those small numerical differences.

const ctx = new (window.AudioContext || window.webkitAudioContext)();
const osc = ctx.createOscillator();
const compressor = ctx.createDynamicsCompressor();
const analyser = ctx.createAnalyser();
const gain = ctx.createGain();
gain.gain.value = 0.0;
osc.type = "triangle";
osc.frequency.setValueAtTime(10000, ctx.currentTime);
osc.connect(compressor);
compressor.connect(analyser);
compressor.connect(gain);
gain.connect(ctx.destination);
osc.start(0);
const buffer = new Float32Array(analyser.frequencyBinCount);
analyser.getFloatFrequencyData(buffer);

The code above shows how AliExpress maintained an audio stream using a zero-gain GainNode connected to the destination. This trickery prevents operating systems from shutting down to idle, which is crucial for Bluetooth devices. By keeping the stream live, the script ensured Bluetooth multipoint devices couldn't switch audio focus, as the system thought it was still handling an active audio output.

Why It Matters

This technique is a big deal in terms of security and privacy. Unlike more sensitive browser functions like getUserMedia or the Geolocation API, you don't need user permission to start an AudioContext and run synthesis graphs. Plus, there are no visual cues from browsers when these audio graphs are running, even at zero volume. This transparency gap makes things trickier for enterprise security, especially for e-commerce platforms using client-side risk scoring to tackle threats like account takeovers and bot attacks.

Here's the issue: there's a structural permission gap in modern W3C specifications that needs attention. E-commerce platforms have to juggle security needs and user privacy expectations. Without formal controls or isolation mechanisms for anti-fraud telemetry, there's a risk these defenses could clash with device states and compromise user privacy.

Responses from Browser Vendors

After this discovery, privacy-centric browsers like Brave have been emphasizing their strategies. Brave uses "farbling," which adds random noise to audio buffers. This makes frequency data unpredictable, reducing fingerprinting risk while keeping web apps functional. By varying the frequency data unpredictably, it becomes tough for scripts to pick up consistent hardware traits.

Firefox, on the other hand, uses mathematical bucketing and canonical normalization to fight fingerprinting. These techniques standardize precision to eliminate hardware-specific differences, keeping users anonymous. By grouping audio processing routines into precision bins, Firefox tackles the FPU-level differences that fingerprinting scripts try to exploit.

What I'd Do About This

Maintaining a production codebase, especially in e-commerce or sectors with sensitive user data? You should definitely audit your web applications for security. Here are some steps I suggest:

• Review Third-Party Scripts: Scrutinize all third-party scripts on your site for privacy issues or tracking tactics like those used by AliExpress. Check for any Web Audio API use or similar technologies that can be exploited for fingerprinting.
• Implement Permissions: Start asking for explicit permissions for features that might invade privacy, even if it's not required by browsers yet. Although audio context initialization doesn’t need permission now, having an internal policy to get user consent can boost transparency and trust.
• Educate Users: Let your users know about your privacy practices and give them the option to opt-in or out of tracking mechanisms. Explaining data use and offering choices helps users make informed decisions about privacy.
• Adopt Privacy-Centric Tools: Consider using browser features or third-party tools that resist fingerprinting, like those in Brave or Firefox. These add an extra protection layer against tracking attempts, keeping user data safe.

What This Does Not Solve

Even if you tackle audio fingerprinting, remember there are other privacy hurdles out there. Audio fingerprinting is just one trick. Developers need to keep an eye on other tracking methods like canvas fingerprinting or WebRTC leaks. These solutions might not kill data leak risks entirely, given that tracking technologies are always changing. The rapid pace of web tech means new tracking methods pop up regularly, so staying vigilant and adaptable is key.

This AliExpress audio fingerprinting incident is a serious privacy worry, but it's also a chance for developers and browser vendors to up their security game. By embracing better privacy practices and educating users, we can move towards a more secure web. This whole scenario is a wake-up call about how crucial transparency, user consent, and collaboration between developers, browser vendors, and users are for protecting digital privacy.