KARR Bluetooth Flaw Lets Nearby Attackers Unlock and Immobilize Millions of Cars

Researchers at the University of California San Diego disclosed severe flaws in the dealer-installed aftermarket KARR Security System, a Bluetooth-enabled alarm and anti-theft device estimated to be present in more than 2 million U.S. vehicles. The vulnerabilities allow an attacker within Bluetooth range to silently unlock doors, disable alarms, trigger horns and lights, and even block the engine from starting, creating both theft and roadside immobilization risks. The researchers said the issue stems in part from a shared embedded authentication key used across KARR devices, which they extracted by reverse-engineering the official mobile app and validating with a proof-of-concept Android tool.

The findings also raised privacy concerns because KARR devices broadcast identifiable Bluetooth signals that could be correlated with public WiGLE data to estimate deployment and potentially infer vehicle movements or frequently visited locations. Acrisure Protection Group, which sells the KARR system, released a firmware update after responsible disclosure, but remediation requires owners or dealerships to identify the hardware and manually apply the patch through the KARR smartphone app. Researchers warned that many drivers may not realize the device is installed, because it is often added by dealerships and can remain in vehicles after resale.