Over Two Million Vehicles Across the United States Contain a Critical Security Flaw in Aftermarket KARR Security Systems That Allows Remote Hacking

The rapid transformation of the modern automobile into a complex, connected computer on wheels has brought with it an entirely new frontier of cybersecurity risks. While consumers have grown accustomed to managing software updates for smartphones and laptops, the automotive industry presents a much higher-stakes landscape. A recent investigation by researchers at the University of California San Diego (UCSD) has exposed a massive, hidden vulnerability affecting more than 2 million vehicles across the United States. The breach centers on the KARR Security System, an aftermarket alarm and anti-theft device often installed by car dealerships before a vehicle even reaches the showroom floor.

For millions of unsuspecting drivers, this device is a "silent passenger"—a piece of hardware wired into the vehicle’s most sensitive electronic systems without their knowledge or consent. According to the UCSD research team, a critical security failure within the system’s Bluetooth communication protocol allows anyone within range to send wireless commands to the vehicle. These commands can effectively bypass the alarm, unlock doors, flash headlights, sound the horn, or, most alarmingly, disable the vehicle’s ignition, leaving a driver stranded in traffic or at a vulnerable location.

The Anatomy of an Unintended Security Threat

The KARR Security System, managed by the Acrisure Protection Group, is frequently used by dealerships to track and secure inventory on large lots. The business model, however, often results in the device remaining active or dormant in the vehicle long after it has been sold to a consumer. In many instances, the car buyer is unaware of the device’s presence; in others, they may have declined the feature as an add-on during the purchasing process, yet the hardware remains hardwired under the dashboard.

The technical flaw discovered by the UCSD team is as simple as it is catastrophic: a universal authentication key. By reverse-engineering the KARR smartphone application, researchers discovered that the same digital "key" is used across the entire fleet of installed devices. Because the KARR system uses a static, shared credential to authenticate commands sent via Bluetooth, any attacker with basic knowledge of the protocol and a custom-built application can masquerade as the vehicle’s owner.

Unlike a remote key fob, which uses rolling codes and sophisticated encryption to prevent replay attacks, the KARR system’s implementation of Bluetooth communication lacks the robust security standards required for modern vehicle safety. The researchers successfully demonstrated that they could scan for these Bluetooth signals in real-time, identify vulnerable vehicles in their immediate vicinity, and issue commands that the car would accept without further verification.

A Chronology of Discovery and Disclosure

The origins of this discovery date back to 2018, when UCSD researcher Nishant Bhaskar, while investigating radio-enabled credit card skimmers at gas stations, began noticing persistent, unrecognized Bluetooth signals. His inquiry eventually led him to the Federal Communications Commission (FCC) database, where he identified the signals as originating from KARR alarm equipment.

The project remained dormant until 2024, when graduate researcher Jerry Yu began a deep-dive analysis of the system. The research team’s findings were stark: they found that even when the KARR system is in a "deactivated" state for a car owner, the hardware continues to broadcast a beacon and remains receptive to Bluetooth signals for up to 10 minutes after the ignition is turned off.

The research team formally notified the manufacturer of the vulnerability in January 2025. Despite the severity of the flaw—which impacts a significant percentage of the U.S. vehicle population—it took nearly 18 months for the company to develop and deploy a firmware update. The delay raises critical questions regarding the standard of care for third-party automotive hardware manufacturers, particularly when their products are integrated into the critical electrical architecture of consumer vehicles.

Data-Driven Risks and Industry Implications

The scale of the threat is significant. Using the WiGLE (Wireless Geographic Logging Engine) database, which aggregates crowdsourced radio signal data, the UCSD team estimated that at least 2 million vehicles are currently affected. The researchers’ fieldwork further confirmed the pervasiveness of the issue; during a 20-minute drive around the outskirts of the UCSD campus, they detected 97 vehicles equipped with the vulnerable KARR hardware.

The implications for vehicle safety are broad. While the KARR system itself does not directly control the engine’s CAN bus (the internal network that dictates steering or braking), the ability to disable the ignition provides a "force multiplier" for car thieves. Once a thief uses the KARR vulnerability to unlock a vehicle and gain interior access, they can utilize readily available, inexpensive locksmith tools to interface with the vehicle’s diagnostic port and program a new, functional key in a matter of minutes.

Furthermore, the researchers identified a "mayhem" potential. Because the Bluetooth protocol allows for mass broadcasting, a malicious actor could theoretically target multiple vehicles in a parking lot or a traffic jam simultaneously, triggering their alarms and lights, or inducing a localized, mass-scale disruption.

Manufacturer Response and Remediation

When contacted regarding the findings, a spokesperson for the Acrisure Protection Group characterized the vulnerability as "highly complex" and claimed it presents a "low risk to customers under real-world conditions." Despite this characterization, the company confirmed the release of a mandatory firmware update designed to address the authentication issue.

The manufacturer has directed customers to check for the update via the official KARR Security mobile application. For users who have not previously installed the app, the process involves downloading it from the Apple App Store or Google Play Store, pairing it with the vehicle’s specific KARR module, and navigating to the "customer service" tab to trigger the firmware update.

However, a major hurdle remains: the "orphan" vehicle problem. Many of the 2 million affected cars have been sold, resold, or traded in, meaning the original contact information for the current owner is not in the manufacturer’s database. Without a direct line of communication to the owners of these vehicles, the company faces significant difficulty in ensuring that the patch is widely applied.

Broader Cybersecurity Considerations for the Automotive Sector

The KARR situation serves as a bellwether for the growing pains of the "Software-Defined Vehicle" era. It highlights the dangers of the fragmented supply chain in the automotive industry, where manufacturers, dealerships, and third-party accessory providers often operate in silos. When a security vulnerability exists in an aftermarket component that is physically integrated into the car’s wiring, the lines of responsibility become blurred.

Stefan Savage, a professor at UCSD and a pioneer in automotive security research, noted that the KARR vulnerability represents an unprecedented challenge. "It affects a large number of vehicles, the manufacturer of your car can’t fix it, and you don’t even know you have the problem," Savage said. He emphasized that the situation provides the ideal conditions for a criminal actor—a high-reward target with little to no defensive perimeter.

As regulators and industry bodies look to address the future of vehicle cybersecurity, the KARR case is likely to prompt a re-evaluation of how third-party electronics are integrated into new and used vehicles. Currently, the onus is on the individual consumer to identify if their vehicle is affected. Owners are advised to look for KARR or "SWDS" (SouthWest Dealer Services) branding on their driver-side window or a small, aftermarket button with a blinking LED light located under their dashboard.

Ultimately, the KARR vulnerability demonstrates that in the modern era, car maintenance is no longer just about tires and oil changes—it is about managing the digital footprint of every component installed in the vehicle. Until there is greater transparency and accountability regarding aftermarket installations, drivers remain vulnerable to the hidden code buried within their own vehicles.