Secretly from customers: hidden surveillance system discovered on AliExpress

Chinese e-commerce giant AliExpress used code on its homepage that activated the computer's audio system to create a "digital passport" of the device. The code, linked to Alibaba's security systems, launched inaudible audio processes, measuring differences in how different computers process sound. This technology allows device identification and activity tracking without cookies.

Chinese e-commerce giant AliExpress used code on its homepage that activated the computer's audio system to create a kind of "digital passport" for the device. This was revealed on Monday, August 24, in publications by industry outlets focused on online trade security. This method allows identifying the computer and tracking user activity even without using cookies. The code, reportedly linked to Alibaba's security systems (owner of the AliExpress marketplace), launched inaudible audio processes in the browser. The system measured tiny differences in how different computers process the same audio signal. These differences depend on the processor, sound card, operating system, and browser. The combination of all these factors can serve as a unique marker for a specific device. This activity was discovered almost by accident. A developer noticed that his Bluetooth headphones, connected to multiple devices, would not switch from the computer to the smartphone while an AliExpress tab was open in the browser. Closing the tab made the problem disappear. Checking the site's code revealed that the cause was precisely this background audio activity. The Brave browser was among the first to detect this activity. Brave noted that it has been protecting users from such audio-based tracking for over six years.