David Baillot/University of California San Diego/Jacobs School of Engineering
A security flaw in an aftermarket car alarm called KARR lets anyone standing within about five yards unlock a vehicle and disable its alarm, according to researchers at the University of California San Diego. The vulnerability sits in hardware that dealerships install across their lots to manage inventory and deter theft, and it stays active even when a buyer declines to pay for the alarm service after a sale.
UC San Diego estimates at least 2.2 million vehicles on the road today have the vulnerable hardware, most of them sold at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California since 2017. Resales have carried several hundred thousand more across the rest of the United States, Canada, and as far as Japan.
The flaw traces back to a single authentication key shared across every affected KARR device. UC San Diego's writeup compares it to setting every device in a product line to the same password, with no way for owners to change it. Once researchers cracked that key, they could send commands to any nearby unit: unlocking doors, disabling the alarm, honking the horn, flashing headlights, and keeping a parked car from starting. The device can't start a car on its own or take control of one already moving. Jerry Yu, a computer science Ph.D. student and the paper's co-first author, said the flaw still lowers the bar for theft: "Instead of smashing a window to get access to a vehicle, thieves could simply connect remotely via Bluetooth to the device inside the vehicle, and make it unlock car doors."
Researchers also found that public databases store location data tied to the devices' Bluetooth signal, which they say could let someone track where a specific car has repeatedly been parked, a privacy risk separate from the unlocking flaw. Acrisure Protection Group, which sells the KARR system, called the attack highly complex and said it presents low risk under real-world conditions. UC San Diego hasn't reported finding evidence that criminals have exploited the flaw against actual vehicle owners.
Researchers first disclosed the flaw to Acrisure in January 2025 and also reported it to the National Highway Traffic Safety Administration. Acrisure released a firmware update on July 20 that closes the vulnerability. Because KARR is third-party hardware, automakers can't push the fix through their own software update systems, so owners have to install it themselves through the KARR app.
UC San Diego's team says removing the hardware entirely isn't a simple alternative, since it requires cutting and reconnecting wiring tied into the car's ignition system. The researchers plan to detail how they reverse-engineered the vulnerability at the DEF CON conference on August 9 and the USENIX Security conference on August 12.
Vehicle owners should check their driver's side window for a KARR or SWDS sticker, or look under the dashboard for a small button with a blinking light. If you find one, download the KARR Security app for iPhone or Android, connect it to the car, and follow the app's prompts to install the firmware update. Confirm the update finishes before closing the app. More information is available at karrsecurity.com. If you can't find the hardware or complete the update yourself, contact the dealership that sold you the car or KARR customer support directly.
Read next: A $129 dongle for your car helps avoid breakdowns and cut repair bills
