Inaudible sounds used to fingerprint browsers catch AliExpress red-handed
摘要
研究人员马修·卡拉汉发现，中国零售商阿里速卖通（AliExpress）网站通过向访问者浏览器发送人耳听不见的声音来识别用户，这一行为干扰了他蓝牙耳机的正常使用。他在加载该网站首页时，手机音频意外中断，调查后确认网站运行了两个高度混淆的脚本，利用WebAudio API分析浏览器产生的锯齿波，从而生成独特的浏览器指纹。这种技术属于过时的追踪手段，用户无法察觉
Chinese retailer AliExpress has been caught fingerprinting visitors after one of the metrics—an outdated technique that measures inaudible sounds it sends to browsers—impeded a researcher's ability to use his bluetooth headphones.
Researcher Matthew Callaghan said he stumbled on the stealthy tracking by mistake. After loading the AliExpress homepage, audio from his phone stopped playing over his multipoint headphones, which accept connections from more than one device at a time. He set the headphones to play sounds from his phone except when his PC was producing audio. Each time he loaded AliExpress, the phone audio stopped. Each time he closed the tab the site was loaded into, the phone was once again audible.
Users can't hear it, but browsers can
While investigating the odd behavior, Callaghan said he found two highly obfuscated scripts. Together, they rendered a graph that analyzed the WebAudio readings of each visiting browser. This graph acted as an oscillator that measured Sawtooth waves, which are common in output from digital audio.
转载信息
评论 (0)
暂无评论，来留下第一条评论吧