How websites are tracking you with silence

When a chap called Matt noticed his Bluetooth headphones wouldn't switch to his phone, he was surprised to realise the reason was a single AliExpress webpage sitting open in his browser - playing nothing at all, at zero volume. And yet somehow his hardware could hear it. Audio fingerprinting is one of the sneakiest tracking tricks on the web.

Meanwhile, the intelligence agencies of the "Five Eyes" (not Five Guys) have got together and published advice on how companies should communicate after a cyber attack. The summary? For the love of God, stop calling every breach "sophisticated."

All this and more in episode 484 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest Danny Palmer.

EPISODE LINKS:

• Hackers demand $2.3M in ransom after breaching Berlin government network - Anadolu.
• Deux suspects interpellés dans le cadre des enquêtes ouvertes après le piratage du fisc - France Info.
• Hackers are stealing Claude tokens from subscribers - TechCrunch.
• AliExpress accused of fingerprinting shoppers with silent audio trick that also muted a dev's headphones - The Register.
• AliExpress webpage keeping multipoint Bluetooth headphones active with WebAudio fingerprinting - Matt Callaghan’s blog.
• Audio Fingerprinting: What It Is + How It Works with Web API - Fingerprint.
• Communicating Under Pressure: Best Practices for Service Providers - CISA.
• World Stone Skimming Championships.
• Mind games and a ‘toss master’: world stone skimming contest returns to Scotland after cheating scandal - The Guardian.
• World Stone Skimming Championships - Every Toss 2025 - YouTube.
• ”The Pirates’ Code: Laws and Life Aboard Ship”  by Rebecca Simon - Waterstones.
• Smashing Security merchandise (t-shirts, mugs, stickers and stuff)

SPONSORS:

• ThreatLocker - Book a demo today and start securing your organisation.
• Vanta - Expand the scope of your security program with market-leading compliance automation… while saving time and money. Smashing Security listeners get $1000 off!
• Intruder - The depth of a manual pentest, on-demand. Start an AI pentest in minutes - 25% off your first pentest for Smashing Security listeners.

SUPPORT THE SHOW:

Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.

Become a supporter! Join Smashing Security PLUS via Patreon or Apple Podcasts for ad-free episodes on our early-release feed!

FOLLOW THE SHOW:

Follow us on Bluesky or Mastodon, or on the Smashing Security subreddit, and visit our website for more episodes.

THANKS:

Theme tune: "Vinyl Memories" by Mikael Manvelyan.

Assorted sound effects: AudioBlocks.

Privacy & Opt-Out: https://redcircle.com/privacy