{"id":18540,"date":"2026-08-25T08:03:49","date_gmt":"2026-08-25T15:03:49","guid":{"rendered":"https:\/\/jasonsblog.ddns.net\/?p=18540"},"modified":"2026-08-25T08:03:49","modified_gmt":"2026-08-25T15:03:49","slug":"alibabas-aliexpress-caught-tracking-user-audio-systems","status":"publish","type":"post","link":"https:\/\/jasonsblog.ddns.net\/index.php\/2026\/08\/25\/alibabas-aliexpress-caught-tracking-user-audio-systems\/","title":{"rendered":"Alibaba\u2019s Aliexpress Caught Tracking User Audio Systems"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">It just goes to show the big tech companies don&#8217;t have a lot of respect for users. And why I like to use Firefox with uMatrix and uBlock Origin, as uMatrix lets me see the associated servers and elements being pulled in for a site allowing me to enable or block them, with uBlock Origin blocking ads, malware, telemetry and other well known issues. And strange this article plugged Brave instead of uBlock Origin that it uses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cybernews.com\/security\/aliexpress-alibaba-audio-systems-tracking\/\" target=\"_blank\" rel=\"noopener\">https:\/\/cybernews.com\/security\/aliexpress-alibaba-audio-systems-tracking\/<\/a><\/p>\n\n\n<div class=\"wp-block-ub-divider ub_divider ub-divider-orientation-horizontal\" id=\"ub_divider_19d9d4ef-e912-45c7-8d0b-a53c8e6c5838\"><div class=\"ub_divider_wrapper\" style=\"position: relative; margin-bottom: 2px; width: 100%; height: 2px; \" data-divider-alignment=\"center\"><div class=\"ub_divider_line\" style=\"border-top: 2px solid #ccc; margin-top: 2px; \"><\/div><\/div><\/div>\n\n\n<h5 class=\"wp-block-heading\">Is AliExpress listening to you?<\/h5>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img decoding=\"async\" src=\"https:\/\/media.cybernews.com\/images\/featured-big\/2026\/08\/alibaba-user-tracking.jpg\" alt=\"Two individuals looking at their smartphones with Alibaba logo in the background\" style=\"aspect-ratio:1.8181818181818181;width:1200px;height:auto\"\/><figcaption class=\"wp-element-caption\">Alibaba leverages users&#8217; audio to track them. Image by Mamun Sheikh via Shutterstock\/Cybernews.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">By Gintaras Radauskas<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Key takeaways:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A developer found AliExpress using silent browser audio signals to fingerprint devices after the site disrupted their Bluetooth headphones.<\/li>\n\n\n\n<li>The scripts also collect graphics, hardware, network, and interaction data, then send fingerprints to Alibaba telemetry servers.<\/li>\n\n\n\n<li>AliExpress may use fingerprinting to fight fraud and abuse, but users receive no clear notice or consent.<\/li>\n\n\n\n<li>Privacy browsers can limit this tracking; Brave says it blocked the AliExpress scripts involved.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Key Takeaways by <a href=\"https:\/\/nexos.ai\" target=\"_blank\" rel=\"noopener\">nexos.ai<\/a>, reviewed by Cybernews staff.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A developer using Bluetooth headphones has accidentally exposed a sophisticated fingerprinting technique that AliExpress, a massive online retailing platform owned by Alibaba, uses to track users.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The developer, \u201claserphile,\u201d wrote on their blog that they recently ran into some weird issues with their Bluetooth headphones.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They couldn\u2019t play music via their phone when, at the same time, the AliExpress website was open on their PC.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The headphones, laserphile explained, support multipoint Bluetooth audio so they can be connected to the PC and phone at the same time, for instance, playing music on the phone and announcing notifications through the PC.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cShortly after loading the AliExpress homepage, audio from my phone would stop playing. Closing the AliExpress tab fixes it immediately,\u201d the developer <a href=\"https:\/\/blog.laserphile.com\/2026\/08\/aliexpress-webpage-keeping-multipoint.html\" target=\"_blank\" rel=\"noopener\">said in the blog post<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cMuting the tab\/Firefox\/Windows does not help, and there is no visible video, music, or other media playing on the page. This seemed suspicious enough to investigate.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It turns out that Alibaba has been secretly leveraging AliExpress users\u2019 audio systems to track them and build detailed fingerprints of them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Fingerprinting is a way for websites to identify users without cookies \u2013 it\u2019s widely used, if secretly. But in this case, the technique is unique.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Users aren\u2019t being recorded: AliExpress plays a silent sound and measures how users\u2019 devices process it to fingerprint them.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Laserphile found this out after inspecting the website\u2019s hidden code and discovering background scripts holding his computer\u2019s audio pipeline wide open.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The AliExpress site was using the browser\u2019s WebAudio API to run invisible sound waves at zero volume. By measuring tiny hardware differences in how each PC processed those signals, the site created a unique digital fingerprint to track devices \u2013 without user knowledge or consent.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The secret audio path froze the developer\u2019s Bluetooth connection while covertly scraping hardware memory, screen dimensions, and network data in the background.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The data collection extends beyond audio. Further inspection revealed that the same scripts also measure canvas, WebGL, hardware specs, WebRTC, mouse\/touch events, and automation indicators. All of these form a broad device fingerprint that is sent back to Alibaba\u2019s telemetry servers.<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img decoding=\"async\" src=\"https:\/\/media.cybernews.com\/images\/1024w\/2026\/05\/alibaba_0520.jpg\" alt=\"Man walks past Alibaba logo\" style=\"aspect-ratio:1.8181818181818181;width:1200px;height:auto\"\/><figcaption class=\"wp-element-caption\">A man walks past the Alibaba logo in Beijing. Photo by REUTERS\/Florence Lo<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cAudio fingerprinting works because small differences in browser versions, operating systems, audio libraries, and hardware can produce slightly different results from the same generated signal,\u201d says laserphile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cIt is not necessarily enough to uniquely identify a device by itself, but it becomes much more useful when combined with canvas, WebGL, hardware, timing, and interaction data.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Alibaba and its AliExpress platform may have plenty of reasons to apply this sort of sophisticated fingerprinting to their users.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They need to deal with fake accounts, fraud, and coupon abuse \u2013 but they can also use large datasets of user behavior to better market products and services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cBut personally, I do not want a shopping homepage silently exercising my graphics, audio, WebRTC, hardware, and motion APIs, etc, to track my behaviors, especially if it has such an annoying effect as blocking my music. Perhaps if AliExpress wasn\u2019t blocking my music, I never would\u2019ve looked into what the site was doing,\u201d said laserphile.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What now seems to be the only reliable and straightforward way to stop audio fingerprinting is using <a href=\"https:\/\/www.firefox.com\/pl\/features\/block-fingerprinting\/\" target=\"_blank\" rel=\"noopener\">privacy-centric browsers like Firefox<\/a> or Brave.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Brave, for instance, injects random data into the browser&#8217;s output so you show a different fingerprint to different sites. In this case, Brave has also blocked the scripts AliExpress uses for tracking.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It just goes to show the big tech companies don&#8217;t have a lot of respect for users. And why I like to use Firefox with uMatrix and uBlock Origin, as uMatrix lets me see the associated servers and elements being pulled in for a site allowing me to enable or block them, with uBlock Origin [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-18540","post","type-post","status-publish","format-standard","hentry","category-tech","category-world"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":7}},"featured_image_src":null,"author_info":{"display_name":"Jason","author_link":"https:\/\/jasonsblog.ddns.net\/index.php\/author\/jturning\/"},"_links":{"self":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/comments?post=18540"}],"version-history":[{"count":1,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18540\/revisions"}],"predecessor-version":[{"id":18541,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/posts\/18540\/revisions\/18541"}],"wp:attachment":[{"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/media?parent=18540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/categories?post=18540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasonsblog.ddns.net\/index.php\/wp-json\/wp\/v2\/tags?post=18540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}