Audio fingerprinting secretly tracks web use
A new technique is allowing major websites to monitor users’ online activity. Audio Fingerprinting has nothing to do with a device’s microphone, but instead relies on the way in which the audio signal of each machine is processed. A third-party tracker uses the technique to send low-frequency sounds to a user’s device. Once processed, a unique fingerprint is created based on the device’s hardware and software capabilities. This is providing a valuable new tool to a range of interested parties, including Google, marketing organisations and law enforcement. Researchers at Princeton University discovered that Google has, through a number of domains, tracked users on nearly 80% of all top one million domains using this and other tracking techniques.

"All of the top five third-parties, as well as 12 of the top 20, are Google-owned domains," the researchers note. "In fact, Google, Facebook, and Twitter are the only third-party entities present on more than 10 percent of sites."

Check Your Audio Fingerprint

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session

Despite browsing incognito, blocking advertisements, or hiding your tracks, some websites monitor and track your every move online using a new web-tracking technique calledThis new fingerprinting technique can be utilized by technology and marketing companies to deliver targeted advertisements as well as by law enforcement to unmask VPN or Anonymous users, without even decrypting the traffic.Researchers at Princeton University have conducted a massive privacy survey and discovered that Google, through its multiple domains, is tracking users on nearly 80 percent of all Top 1 Million Domains using the variety of tracking and identification techniques.Out of them, the newest tracking technology unearthed by the researchers is the one based on fingerprinting a machine's audio stack through the AudioContext API The AudioContext API is not collecting audio played or recorded on a machine, but rather harvesting the audio signals of the each machine that is then using it to reveal unique browser and device combinations.The method has nothing to do with the device's microphone, as it relies on the way a signal is processed.A third-party tracker uses the AudioContext API to send low-frequency sounds to a user's computer and then measures how the computer processes the data, creating a unique fingerprint based on the hardware and software capabilities of the user's computer."A script from the company Liverail checks for the existence of an AudioContext and OscillatorNode to add a single bit of information to a broader fingerprint. More sophisticated scripts process an audio signal generated with an OscillatorNode to fingerprint the device. This technique appears conceptually similar to that of canvas fingerprinting. Audio signals processed on different machines or browsers may have slight differences due to hardware or software differences between the machines while the same combination of machine and browser will produce the same output."The researchers, Assistant Professor Arvind Narayanan and graduate student Steven Englehardt, have created a live demonstration page of the technique. So, if you want to check your audio fingerprint, you can check on the demo page.The audio fingerprinting technique is not widely adopted but joins a number of other approaches that could be used in combination for tracking users as they browse the Internet.To carry out measurements to track the trackers, the researchers said they used a custom piece of an open-source software called OpenWPM, which loads sites in Chrome, Firefox and Internet Explorer, collecting data on the tracking loaded on each page.Another widely used method to track online users is fingerprinting technique based on the HTML Canvass API and WebRTC local IP discovery.From last few years, many websites and third-party trackers are utilizing the fingerprinting power of HTML5 Canvas , which is a HTML element used to dynamically generated an image in your browser's web page.For the detailed study, you can read this full PDF full here.