AliExpress Caught Playing Silent Audio to Secretly Fingerprint Your Hardware
Forget sneaky cookies: Alibaba found a way to snoop on your PC hardware by pumping inaudible sound into your headphones just to tag you across the web.
A cybersecurity researcher noticed that multi-point Bluetooth headphones stubbornly refused to switch back to a smartphone whenever an AliExpress tab was open. It turned out the storefront was secretly keeping the computer's audio channel active by generating inaudible sound waves to build a persistent hardware fingerprint.
Instead of recording through the microphone or asking for invasive browser permissions, two heavily obfuscated security scripts from Alibaba create hidden WebAudio graphs right on the homepage. These scripts generate a synthetic sawtooth audio wave, run it through the system, and route it to an output node with zero volume. While the human ear hears dead silence, the machine processes every minuscule processing anomaly.
Every combination of CPU, sound card, and browser engine renders that zero-volume audio wave with tiny, unique variations. AliExpress measures these exact micro-differences to identify the device, bundling the audio profile with screen dimensions, installed fonts, WebGL data, and mouse movements into a permanent digital fingerprint that survives even when cookies are wiped clean.
Standard browser tab muting does nothing against this trick because no standard HTML5 media player is running. The tracking scripts, identified as collina.js and fireyejs.js, can only be stopped in their tracks by manually blocking the underlying asset domains using content blockers like uBlock Origin.
Web stores have evolved from simply selling cheap cables to running diagnostic audio benchmarks on user silicon without consent. The entire modern web ecosystem has degraded into an aggressive surveillance pipeline where even absolute silence is weaponized for tracking metrics.
Source: LaserPhile
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.