Over 2 Million Cars Have a Hidden, Hackable Alarm

A team of security researchers at UC San Diego has uncovered a severe vulnerability in the KARR Security System, an aftermarket car alarm installed in more than 2 million vehicles across the US. The flaw allows any attacker within Bluetooth range to unlock the car, disable the ignition, or trigger the horn and lights—all without any physical access. The device is typically installed by car dealers without the buyer's knowledge, and remains in the vehicle even if the buyer declines to pay for it.

The Flaw: A Single Shared Authentication Key

The root cause is a single authentication key shared across all KARR devices. The researchers found this key hardcoded in the KARR smartphone app. By reverse-engineering the app, they created a proof-of-concept Android app that spoofs radio commands accepted by any nearby KARR device.

> "Once we reverse-engineered their application, we quickly realized after understanding their internal authentication protocol that it was so simple that we could extract it and re-implement it as our own application," said Jerry Yu, the graduate researcher who led the analysis.

The key allows the attacker to send commands to unlock doors, disable the ignition (preventing the car from starting), and trigger the horn or lights. The device remains beaconing and accepting Bluetooth signals for up to 10 minutes after the car is turned off, expanding the attack window.

Impact: Theft, Tracking, and Mayhem

The researchers demonstrated multiple attack scenarios:

While the vulnerability doesn't allow starting the engine, the researchers showed that once inside, a thief can use a locksmith tool (available online) to create a working key in minutes. The KARR flaw removes the need to break a window or trigger an alarm, making the theft much easier.

Additionally, the Bluetooth beacon from the KARR device can be used to track a car's location over time. The researchers used the open-source WiGLE database to estimate the number of affected vehicles and found that they could locate vulnerable cars virtually anywhere.

The Patch: How to Update

Acrisure Protection Group, the company behind KARR, released a firmware update on July 11, 2024—about 18 months after being notified by UCSD. The company claims the vulnerability is "highly complex" and "low risk," but the researchers and WIRED's tests show otherwise.

To patch your vehicle:

  1. Check for a KARR sticker on the driver-side window or a small button with a blinking light under the dashboard.
  2. Download the KARR Security System app (Android or iOS).
  3. Connect to the vehicle's KARR alarm via Bluetooth.
  4. Tap "Customer Service" then "Firmware Update."

If you don't have the app, you'll need to install it first. The researchers estimate that at least half of affected owners never requested the device.

Why This Matters for Developers

This incident highlights the dangers of insecure IoT components deployed without user consent. The KARR device is essentially a Bluetooth-enabled microcontroller wired directly into the CAN bus of the vehicle—a design pattern that should raise red flags. The shared authentication key is a classic rookie mistake, akin to using a hardcoded password in a web app.

For developers working on connected devices, this serves as a cautionary tale: never use a single global secret for authentication, and always ensure that users are aware of and can manage the devices in their systems.

What You Should Do Now

If you own a car, especially in Southern California where the devices are most common, check for the KARR sticker. If you find one, update the firmware immediately. If you don't, consider yourself lucky—but stay vigilant. The next hidden device might not have a patch.