Web Audio API technology in Anti-Fraud systems and methods of user identification

17.11.24

Web Audio API is a powerful tool for working with audio in the browser, providing the ability to process, synthesize and analyze audio signals. Originally created for creating interactive sound effects, games and music applications, the technology has found application in anti-fraud systems, where its capabilities allow identifying unique characteristics of devices.

#### History and purpose of Web Audio API

Web Audio API was introduced as part of the HTML5 specification in the early 2010s. It was developed to replace legacy technologies such as Flash, providing high performance and versatility in creating audio content.

The first implementation of the technology was introduced by Google in the Chrome browser in 2011. By 2014, Web Audio API became a standard supported by all modern browsers.

The main purpose of the Web Audio API is to create and process real-time audio, including generating sounds, adding effects, and analyzing audio data.

However, as in the case of Canvas, one of the unexpected applications of Web Audio API is in anti-fraud systems, where its capabilities are used to unique user devices.

#### Web Audio API technological capabilities

Web Audio API provides developers with an extensive set of tools for working with sound:

- **Generation of sounds.** Creation of simple and complex sounds, including synthesizer effects.
   - **Audio processing.**The ability to apply effects such as reverb, filters, and equalization.
   - **Analyzing audio data. **Web Audio API allows you to analyze audio signals in real time, obtaining frequency response and amplitude data.

These capabilities make the Web Audio API a versatile web development tool for games, multimedia, and interactive applications.

#### Web Audio API and anti-fraud: protection from fraudsters

Anti-fraud systems use the Web Audio API to create an audio fingerprint, a digital fingerprint of a device that helps uniquely identify a user.

#### How does the Web Audio API help identify a user?

When a browser generates audio or analyzes an audio signal, each device processes the audio slightly differently. This is due to hardware and software features:

- Differences in digital signal processors (DSPs).
- Use of different audio card drivers.
- Peculiarities of Web Audio API implementation in browsers.

These factors cause the same audio processed by different devices to contain unique characteristics that can be captured. Anti-fraud systems use these features to create a device fingerprint by analyzing audio signals at the level of frequency and time characteristics.

#### Web Audio Fingerprint Spoofing Techniques

Attackers trying to bypass anti-fraud systems use various methods to spoof the audio fingerprint:
   - **Signal distortion.** Embedding small changes in the audio signal to make the device fingerprint appear unique. This could be changing the amplitude, phase, or adding noise.
   - **Using pre-recorded data.** Pre-recorded audio signals can spoof the actual rendering of the audio, producing spurious data. This approach makes it difficult to detect spoofing because the signals look correct.
   - **Audio hardware emulation.** Emulator programs can create an audio fingerprint identical to the real device, bypassing verification.

#### How do anti-fraud systems detect fingerprint spoofing?

Anti-fraud systems use a variety of approaches to detect tampering:

- **Frequency response analysis.** By comparing spectrograms of audio signals, systems can detect anomalies characteristic of artificially altered data.
   - **Dynamic Signal Generation.** Creation of audio signals in real time, followed by analysis of their processing. Such tests are more difficult to fake, as they require a fast response from the device.
   - **Comparison with reference data.** The system compares the results of signal processing with the expected characteristics, evaluating deviations.

#### Dynamic Audio Signals

Dynamic tests that involve changing audio characteristics (e.g., frequency or amplitude) make it more difficult for fraudsters. These tests allow you to evaluate device performance in real time and identify inconsistencies in signal processing.

#### WebAudio fingerprint analysis

Let's see what data can be obtained about a user using the Web Audio API by opening to the <a href="https://browserleaks.com/javascript" target="_blank">browserleaks.com/javascript</a> page in our Chrome browser:

![](/media/mdeditor/1_20241117140341287803.png)

Let's open the page in our anti-detect browser:

![](/media/mdeditor/2_20241117142125218362.png)

This site receives a small amount of information using Web Audio API technology.

Let's open our test page <a href="https://test-webapi.tech/audiofull" target="_blank">test-webapi.tech/audiofull</a> on an Intel computer in the Chrome browser:

![](/media/mdeditor/3_20241117142153910276.png)

On this page, under Media Devices, we get information about the device. In the Audio Fingerprint (HEX) section we get the length of the results of two calculations with different jobs to check the device capabilities (Fingerprint Length) and the MD5 Hash result from the encoding of the calculation results and device parameter values. In the Audio Context Data section we can see the device parameters obtained using Web Audio API and their values.

Let's open this page in an anti-detect browser without applying noise:

![](/media/mdeditor/4_20241117142209973530.png)

We can notice that the Audio Fingerprint (HEX) results match, our anti-detect browser does not spoof the calculation results. But it turns out strange that there are no audio output devices in the Media Devices section of our antidetect browser profile.
Let's repeat the check with audio noise overlay in the anti-detect browser:

![](/media/mdeditor/5_20241117143228664114.png)

We can see that the length of the string with the calculation results has increased significantly, and the MD5 Hash value has changed. We can conclude that the Anti-Detect Browser is successfully modifying the Audio fingerprint.
To understand how Anti-Fraud systems can react to such a change, let's check the results on other desktop devices.

AMD computer:

![](/media/mdeditor/6_20241117143258848343.png)

AMD laptop:

![](/media/mdeditor/7_20241117143318096589.png)

Intel laptop:

![](/media/mdeditor/8_20241117143338284552.png)

Note that we got the same Audio footprint on desktop devices.
Let's continue checking on mobile devices:

![](/media/mdeditor/9_20241117143411565593.jpg)

![](/media/mdeditor/10_20241117143420176965.jpg)

![](/media/mdeditor/11_20241117143448087542.jpg)

For mobile devices, differences in Audio fingerprints are more common than on desktop devices, but it's worth noting that the Fingerprint Length value varies little across device types, unlike the length of the result string in the noise overlay anti-detect browser.

#### Web Audio API Noise Detection

According to the results of the tests we have given earlier, we can notice that when noise is imposed, the size of the result string increases by a significant amount, which can be considered by antifraud systems as a discrepancy with the expected results. Let's try to understand in what way anti-fraud systems can more accurately detect the use of noise in the Audio print.
Let's open our <a href="https://test-webapi.tech/audiotamper" target="_blank">test-webapi.tech/audiotamper</a> test page on a computer in the Chrome browser:

![](/media/mdeditor/12_20241117143535538433.png)

Let's open the same page in an anti-detect browser without noise overlay:

![](/media/mdeditor/13_20241117143553249288.png)

Let's repeat the test using noise in the audio footprint:

![](/media/mdeditor/14_20241117143624945466.png)

In this test, we used the following method to determine noise: we check the parts of the print that should not change on different devices and compare them to reference values. When noise is used, some of the values of such parts of the print change, and this makes it easy to detect spoofing.

Another way to detect spoofing is to get the real values of audio characteristics and compare them with the stated characteristics in the browser properties. Let's try to perform this test, let's open the <a href="https://test-webapi.tech/audiodetect" target="_blank">test-webapi.tech/audiodetect</a> page in Chrome browser:

![](/media/mdeditor/15_20241117143658875729.png)

Let's run the test

![](/media/mdeditor/16_20241117143723162978.png)

Let's open the same page in an anti-detect browser without using noise:

![](/media/mdeditor/17_20241117143754764661.png)

Let's repeat the test in the anti-detect browser with noise applied:

![](/media/mdeditor/18_20241117143829993657.png)

Tests like this allow you to detect spoofing of audio property values by measuring the difference in values and comparing it to acceptable values for specific tests.

#### Conclusion

In this article, we have looked at how the Audio fingerprint is used in anti-fraud systems. The Web Audio API is not unique and anti-fraud systems cannot accurately identify a user using it. At the same time, the use of noise in the Audio fingerprint is detected quite simply and users using spoofing can be easily identified by anti-fraud systems.

In the next article we will continue to analyze the browser technologies used in anti-fraud systems.

*Bannykh M.V.*

Posting terkait

Antidetect

Comparison of WebGPU performance and capabilities on different devices for antifraud tasks

WebGPU technology in Antifraud systems and methods of user identification

This paper describes how WebGPU technology assists anti-fraud systems in user identification and anti-fraud efforts by utilizing unique graphical fingerprints of devices. The capabilities of WebGPU in creating accurate digital fingerprints and detecting c

_Bannykh M.V._

09.11.24

Antidetect

Graph of browser window size changes and their use in antifraud systems.

Browser window sizes and browser events, anti-fraud systems and user identification techniques

Analyzing browser window sizes and events helps anti-fraud systems detect data spoofing and action emulation.

Bannykh M.V.

05.01.25