KARR Car Alarm Bluetooth Flaw Exposes 2.2 Million Cars to Silent Theft

The alarm bolted into your car to protect it can now be used to steal it. A person standing a few steps away pulls out a phone, and your doors pop open while you stand there watching with no idea how. More than 2.2 million cars run this box, and getting in takes no key and leaves no mark.

When you buy a car at a dealership, the sales desk often offers a security upgrade called KARR. A small device gets wired in under the dashboard on the driver’s side, and it talks to an app on your phone over Bluetooth. Through the app it behaves like a key fob: it locks and opens the doors, honks the horn, flashes the lights, and it can stop the car from starting. Dealers use it to keep track of the cars on their lot and to sell theft protection to buyers. The names to look for are KARR and SWDS, which stands for SouthWest Dealer Services, and the company behind the hardware is Acrisure.

Computer scientists at the University of California San Diego took the KARR system apart to see how well it was secured. What they found is the kind of mistake that undoes what the product is for.

These devices share one secret key. Not one key per car. The same key sits in millions of them.

The team downloaded the official KARR app, took it apart, and found that key inside it. Once they had it, they could send commands to any of these devices within Bluetooth range.

A hardcoded key means the secret is written straight into the software and ships the same in each copy of the app. Whoever installs the app is holding it too, they just have to go looking. The general way to pull a secret out of an Android app is to unpack the install file and read the strings inside it. As a simplified illustration of the technique, not the exact steps the team used:

1
2

$ apktool d KARR.apk -o karr_app
$ grep -rIn "key\|secret" karr_app/smali/

Once that constant turns up, you hold the same secret these devices trust. That is the weakness in one line: a password baked into the app, identical across millions of cars, and it cannot be rotated or revoked.

With that key, a person within Bluetooth range can do the same things the app can do. From as far as five yards away, they can open the doors, shut off the alarm, sound the horn, flash the lights, and stop the car from starting. That last part only works while the car is parked and not already running, so your engine will not cut out while you drive. The danger is at the curb: your car sits there, the doors open without a scratch, and from that point a thief uses the kind of tools available to locksmiths to start it and drive off.

Car theft normally starts with a smashed window, and that leaves a trace. This leaves the car untouched, so the owner comes back to an empty spot with no broken glass and nothing to point at.

It gets worse than a car that opens itself. The device keeps broadcasting over Bluetooth while the car runs and for up to ten minutes after it is switched off, and that signal is identifiable enough to mark it as a KARR device rather than a headset or a speaker. Public databases like WiGLE, which volunteers fill by driving around and logging the wireless signals they pass, already store where those signals have been seen. So an attacker does not have to walk a parking lot hoping to find a vulnerable car. Those records show where a given KARR car has turned up before, which is enough to point someone straight at it.

There is a second way this bites, and it has nothing to do with driving your car away. The same feature that keeps a car from starting can be turned on the owner. The radio stays awake for up to ten minutes after you park, so a person within range can catch you as you pull in, switch on the immobilizer, and walk off. Your car will not start, and nothing is physically wrong with it, because the block sits in a box the owner never knew was there.

There is a cruel twist in who gets warned. On a system the owner never paid for, that remote wake-up briefly sounds the horn and flashes the lights, so there is at least something to notice. On a system the owner did pay to activate, the same commands come through silent. The customers who spent money on protection are the ones who get no warning at all.

They counted at least 1.4 million vulnerable cars at first, then kept digging and raised the number to at least 2.2 million. Most were bought at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California from 2017 onward. Because those cars get resold, vulnerable ones now sit in driveways across the United States, in Canada, and as far away as Japan. The device stays active even if the buyer said no to the upgrade and never paid a cent for it.

To feel what 2.2 million means: on a single twenty-minute drive near their campus, the team picked up 97 KARR cars with an ordinary phone.

The discovery started by accident, and years ago. Back in 2018, a group led by then UC San Diego PhD student Nishant Bhaskar was hunting for credit card skimmers hidden inside gas pumps, the kind that steal your card while you fill up. While scanning for those, they kept picking up Bluetooth signals they could not identify. It took serious digging to trace those signals back to the KARR and Rockledge devices. The team, now led by professor Aaron Schulman with Jerry Yu and Yibo Wei as co-first authors, spent the years since taking the systems apart. They will lay out exactly how they did it at the DEF CON conference on August 9 and USENIX Security on August 12, in a paper called BLE Theft Auto.

They are deliberately holding back the step-by-step of the reverse engineering so thieves cannot copy it, and they reported the flaw to the manufacturers and to the National Highway Traffic Safety Administration before going public.

The researchers told Acrisure about the flaw in January 2025. The fix landed on July 20, 2026, about eighteen months later, and twenty days before the team was due to present it at DEF CON. Acrisure called the attack highly complex and a low risk in normal use, while the researchers pulled it off with an ordinary Android phone running their own app.

The update closes the hole, but it runs through the KARR app and the owner has to install it. If half the owners do not know the device exists, half of them are not opening an app to patch it. Pulling the device out is not a practical option for the average owner either, because it is wired deep into the car’s computer and ignition, so getting it out means opening the dashboard and cutting wires that are tangled up with how the car starts.

Nothing official stands behind the fix. There is no CVE number for it, and because the hardware is not the automaker’s, it cannot be pushed out through a normal car software update. No official channel reaches an owner on its own. The only reliable way to know is to look under your own dashboard.

The team points at what would close a hole like this: connecting a new phone should require someone to physically press a button inside the car first. A key that lives only in software, shared across millions of units, was never going to hold.

KARR is not the only one. A second company, Rockledge, makes similar devices the team believes may also be attackable, though it is harder. An attacker would have to be nearby while the owner uses the system, record the exchange, and play it back later. Rockledge had not responded to them by the time they published.

If you bought a car from a dealer since 2017, take two minutes and check:

• → Look for a KARR or SWDS sticker on the driver’s-side window
• → Look under the dashboard on the driver’s side for a small button with a blinking light
• → If you find either one, install the KARR app, connect to the alarm, and open Customer Service, then Firmware Update
• → Do not try to rip the device out yourself, it is wired into the ignition

A box got added to your car, sold as protection, and it turned out to be the easiest way in. The people most exposed are the ones who never knew it was there, driving a car that answers to a code pulled straight from a free app. The firmware fix is out, but it only reaches the owners who hear about it.

Capturing and replaying wireless traffic, putting an adapter in monitor mode to see what devices broadcast, and mapping exposed devices with tools like Shodan are exactly the skills the wireless and IoT chapter of my ethical hacking course builds, step by step:

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

UC San Diego | KARR Security