A Sound No One Hears Gives Away Your Computer - With 25.8 Million AliExpress Users in Germany

An online store can feel a lot like walking into a department store, brightly lit and seemingly harmless. Behind the facade of AliExpress, a shopping platform owned by the Chinese Alibaba Group with around 25.8 million monthly users in Germany (Source: AliExpress/DSA Transparency Report), the measuring of visitors begins the moment the homepage loads, silently and without their knowledge.

It was discovered by accident, of all things because of a pair of headphones. Developer Matt Callaghan had his Bluetooth headphones connected to both his phone and computer at the same time, just as multipoint technology allows. As long as the computer stayed quiet, the music came from the phone. But when Callaghan opened AliExpress, playback suddenly stopped for no apparent reason. Close the tab, and the music came back instantly. Muting the browser or Windows did nothing. Suspicious enough to take a closer look. Callaghan now checked the usual suspects, the page's audio and video elements and its playback calls. The media session information was empty too. The only thing that stood out was the delay: the disruption did not start right away, only after a few quiet seconds. So he listened in on the page from the very beginning and intercepted the component a browser uses to process sound. That is how he found two hidden contexts that quietly switched into a running state and connected themselves to the output.

The excerpt shows the small intervention that caught the browser in the act. The normal AudioContextfunction in the browser was simply replaced temporarily with a monitored version. Every time a website secretly created a new audio context, the browser now wrote a message to the console and showed at the same time where in the code the call came from. That made it possible to see that AliExpress was in fact starting audio processing in the background even though the user could not hear any sound on the page.

The trail led to two heavily obfuscated scripts called collina.js and fireyejs.js. Both build a small sound apparatus inside the browser. An oscillator generates a sawtooth wave, and an analyzer node reads what the browser makes of it. An amplifier turns the volume down to 0 and still sends the result to the output. The user hears nothing. But the computer continues to treat AliExpress as a page actively working with sound and will not let the headphones switch back to the phone. That is when the investigation really got going.

This is different from a video that starts playing on its own. There is no media element that can be stopped with the usual mute button. From the page's point of view, active processing is taking place, and it is precisely the connection to the output that forces the browser to keep calculating the setup continuously. In Callaghan's case, that was enough for Firefox or Windows to keep the audio path open and prevent the headphones from switching cleanly. Mozilla already has a bug report on this behavior.

The silent test is only one measurement among many. The scripts grab the drawing the browser renders onto an invisible surface and read the identifier of the graphics chip along with its finer characteristics. They record the dimensions of the screen and its pixel density. They count the processor's computing units and the available memory. They note installed extensions and the formats the device supports for sound and video. Add to that the behavior of the WebRTC networking component and the time the browser takes to perform its tasks.

It is not just the device being measured, but the person sitting in front of it too. Every movement of the mouse is recorded, every turn of the scroll wheel. The scripts remember touches on the screen and changes to the active window, and they even read the device's tilt and movement. Characteristics that suggest remote-control software are part of it as well. According to Callaghan, the values are encrypted and sent through methods such as fetch or sendBeacon to Alibaba telemetry services. Both scripts sit in a directory called AWSC and, from everything that can be seen, belong to Alibaba's protection against fraud and abuse. A device fingerprint like this serves two purposes at once. It tracks the visitor across sessions, and it separates the real buyer from the machine pretending to be one. Cookies are not much use for that because they can be deleted or copied. A fingerprint built from many independent measurements is much harder to fake. The trick is that the same generated wave comes back slightly differently depending on the browser version and hardware; on its own that says little, but combined it becomes almost unique.

The hand operating the device also gives away whether a human is clicking or a program. AliExpress has plenty of reasons to draw that line: hijacked and fake accounts plague the site, along with programs scraping prices or placing orders every second. Payment fraud is another issue, as is abuse of new-customer coupons. Manipulated reviews are also among the operator's concerns. Like the big players across the internet, the company also uses customer behavior to sell more effectively. The fingerprint, so the thinking goes, could reduce fraud and spare loyal customers the endless task of solving picture puzzles. AliExpress is hardly shy about using its own picture puzzles anyway. What happens to the data once it reaches the servers is something Callaghan cannot see. Maybe it serves as a permanent identifier for the device, maybe it is only one value among many in fraud screening. The company did not respond to questions. Not exactly surprising.

Not every browser gives up information quite so willingly. According to Firefox engineer Tom Ritter, Firefox has made the values produced by audio processing almost identical since version 118; 99.24 percent of users could be assigned to only three large groups. Brave adds randomness to the results and blocks the scripts found on AliExpress. Other characteristics of the device still give websites enough to build a fingerprint. Anyone who dismisses this as nothing more than “old technology” either has not understood where the danger lies - or is simply annoyed that someone else took a closer look.

The two scripts can be blocked specifically. In Raymond Hill's uBlock Origin extension, a few lines under custom filters are enough to hit only collina.js and fireyejs.js, and only when AliExpress requests them. After that, the homepage continues to load normally, but the audio setup stays silent. There is one catch: tabs that are already open have to be closed because blocking a script does not terminate a context it has already created. Because the scripts are tied to fraud protection, blocking them can trigger additional picture puzzles or interfere with logging in. Callaghan plans to disable the rules temporarily if AliExpress refuses to let him make a real payment. Simply browsing products has so far worked without problems. Now we will have to wait and see when the next round of spying shows up.

Callaghan does not dispute that fraud protection serves a purpose. What bothers him is something else about this implementation. It runs right on the homepage, long before the visitor does anything security-sensitive. It collects broadly and is deliberately difficult to understand. Nothing on the surface reveals that sound is being processed in the background. On top of that comes the very real interference with the hardware. A silent test was able to disrupt the switching of Bluetooth headphones while the browser's mute button did absolutely nothing.

When a hidden check occupies the audio path so thoroughly that other connected devices suffer because of it, blocking it starts to look like the more sensible option. What happens to the fingerprint on the servers and how long it remains there is hidden from outside view. Callaghan cannot prove whether it reappears on other Alibaba services either. The code in the browser proves only the measurement and the transmission. Whether anyone on the internet really has nothing but your best interests in mind is something everyone has to decide for themselves, while the homepage has already measured them.