A Broken Bluetooth Headset Exposed Silent Device Fingerprinting on AliExpress

🎧 A Broken Bluetooth Headset Exposed Silent Device Fingerprinting on AliExpress

A researcher's multipoint Bluetooth headset kept refusing to switch back to his phone whenever he had AliExpress open — even muted, even with zero audio playing. Digging into it exposed a silent WebAudio-based fingerprinting technique.

What was happening:

AliExpress's homepage was spinning up hidden AudioContext instances — a sawtooth oscillator → analyzer node → gain node set to 0 → destination. Fully inaudible, but the browser still treated it as live audio, which is exactly what locked the Bluetooth path to the PC.

Stack traces led to two obfuscated scripts, collina.js and fireyejs.js, tied to Alibaba's AWSC anti-fraud tooling. Same scripts were also probing canvas output, WebGL/GPU details, hardware concurrency, device memory, WebRTC behavior, and automation signals — all shipped via fetch() and sendBeacon() to Alibaba telemetry.

No cookies. No permissions. Survives incognito.

Want to test this yourself on any site? Override the native APIs in DevTools before page load:

const origConnect = AudioNode.prototype.connect;
AudioNode.prototype.connect = function(...args) {
console.trace('AudioNode.connect() called', this);
return origConnect.apply(this, args);
};

If a site is building a hidden WebAudio graph, you'll see AudioContext instantiation + connect() calls with stack traces pointing straight to the responsible script.

Firefox has normalized WebAudio output since v118 specifically to curb this, but WebAudio, WebRTC, and even device motion APIs remain an underrated fingerprinting attack surface most security training skips entirely.

Full technical breakdown, detection script, and mitigation steps: https://www.xpert4cyber.com/2026/08/aliexpress-webaudio-fingerprinting.html