When you install an anti-theft system in your car, you reasonably expect it to make your car more difficult to steal. We can debate how useful, or not, various anti-theft systems are, but they should certainly never make your car even easier to steal. That’s exactly what a team of University of California San Diego researchers has discovered about one system in particular, reports Wired. And to make matters worse, many drivers may not even realize this system is installed in their car, adding none of the protection and all of the vulnerabilities.
The device in question is the KARR Security System. Unrelated to the Knight Automated Roving Robot, this KARR provides many of the standard features of modern security systems, such as remote lock/unlock, engine immobilization, and GPS tracking in the event your car is stolen. It is mainly used by dealers, both for security on their own lots before the car is sold, and to offer as an extra-cost add-on for customers. When customers decline, dealers simply deactivate a vehicle’s KARR rather than removing it.
More than two million vehicles have KARR onboard. UC San Diego Today elaborates:
Most of the vulnerable vehicles were bought at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California from 2017 to today. But because these vehicles are resold on the second-hand market, several hundred thousand vulnerable vehicles can also be found throughout the United States, Canada and even as far as Japan. Many vulnerable cars display a sticker with the word “KARR” or “SWDS” on the driver’s-side window.
“SWDS” stands for SouthWest Dealer Services, a subsidiary of Acrisure Protection Group, the parent organization that sells KARR.
It was said that you would deter the thieves, not help them
By reverse-engineering the KARR mobile app, the UCSD researchers were able to write code of their own that allowed them to control every function KARR provides in any vehicle equipped with the system, including inactive devices that dealers left behind. The team demonstrated several of these exploits in this video, and to Wired:
…the researchers showed that they could use their own Android app to send Bluetooth commands to vulnerable vehicles with KARR installed to carry out a wide array of potentially disruptive or dangerous hacking. The demo exploits can, with the tap of a button, unlock a car at a stop light to enable theft or carjacking, instantly paralyze a parked car to prevent it from starting, or even—with a “mayhem” button they built into the app—hack a group of cars to simultaneously and repeatedly trigger their horns and lights, as the researchers demonstrated for WIRED in a UCSD parking lot.
The good news is that, unlike during the rash of Hyundai and Kia thefts, KARR does not allow a would-be thief to start and drive the car. KARR does not have access to ignition controls except to immobilize it, so someone can’t steal the car with a hacked KARR app alone. The bad news is that as an aftermarket system, KARR is not limited to any one make or model, so any vehicle equipped with KARR, regardless of make or model, could have this vulnerability. Unlocking the doors through the app provides easy direct access to the car’s diagnostic port, making it easy to program a key fob and drive away.
The problem and solution
The root of the problem is that KARR uses the same authentication key across all of its devices. The KARR app contains this key to operate the system legitimately, but hackers can extract it from the app to use for their own nefarious purposes. It also doesn’t help that KARR devices have an open Bluetooth connection. Even deactivated units have this, which is what makes it possible to reactivate and exploit them.
Acrisure Protection Group does not seem particularly worried about the exploit:
When WIRED reached out to Acrisure Protection Group about the KARR security flaw, a spokesperson responded in a statement: “The vulnerability described in [UCSD’s] research is highly complex and presents a low risk to customers under real-world conditions. Nevertheless, we responded promptly and developed a firmware update to address the issue.”
Instructions to download and install this update through the KARR app are available on the KARR website, both for activated and non-activated systems. However, responding “promptly” was actually 18 months since UCSD researchers first reported their findings to KARR in January 2025. Their presentations about it at the Usenix security conference and Defcon hacker conference in August may be what prompted the timing of this release. While the vulnerability may be “highly complex,” so are today’s car thieves, who are adept at cloning key fobs and grabbing their signals out of the air. I would hope that a company selling an anti-theft device might take security a little more seriously.
