AliExpress has implemented a sophisticated device fingerprinting mechanism using the WebAudio API, which has led to unexpected Bluetooth connectivity issues. This technique discreetly constructs WebAudio processing graphs in users’ browsers, potentially hindering Bluetooth multipoint audio switching for connected headphones.
Bluetooth Connectivity Disruptions
Security expert Laserphile discovered the issue while using multipoint Bluetooth headphones connected to both a PC and a phone. Opening the AliExpress homepage in browsers like Firefox or Chrome resulted in abrupt audio cutoffs from the phone. Standard methods such as muting the browser or the system audio were ineffective, and only closing the AliExpress tab restored normal audio playback.
Despite the absence of visible media content on the page, further investigation revealed two AudioContext instances being created. These instances were actively connected to the system’s audio destination, albeit producing no audible sound. The activity was traced back to scripts named collina.js and fireyejs.js, which are linked to Alibaba’s anti-fraud and bot detection systems.
Technical Investigation and Findings
Laserphile utilized advanced JavaScript instrumentation to monitor the WebAudio API, uncovering a complex audio graph pattern. This graph involved a sawtooth oscillator connected to an analyzer node and script processor, which then passed through a zero-gain node. Despite the absence of sound, this setup kept the audio processing active, leading Firefox and Windows to treat it as legitimate audio, thus maintaining the Bluetooth connection to the PC.
Beyond audio fingerprinting, these scripts assess various browser and device parameters, including canvas rendering, WebGL details, and hardware specifications. The collected data is encrypted and sent to Alibaba’s telemetry servers, possibly for fraud prevention and user behavior analysis.
Broader Implications and Mitigation
The fingerprinting occurs on the AliExpress homepage, without user consent or visible indicators, raising privacy concerns. A related Firefox bug report and analysis from a Mozilla engineer have confirmed parts of the behavior.
To mitigate these issues, Laserphile suggests using ad blockers like uBlock Origin to block the script paths, which prevents the hidden audio contexts from initiating and restores normal Bluetooth functionality. However, users may encounter additional CAPTCHA challenges as a result, since these scripts are integral to AliExpress’s fraud detection system.
As online platforms increasingly employ sophisticated tracking technologies, users and developers must remain vigilant about potential privacy implications and technical disruptions.
