A car alarm vendor’s coding mistake has left millions of vehicles vulnerable to theft and location tracking. Thanks to the way dealers sell car alarms, many affected drivers don’t even know they have one installed.
The device is the KARR Security System, a Bluetooth-enabled aftermarket alarm built by Acrisure Protection Group. It’s installed by dealers, primarily at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California.
Aftermarket car alarms are a strange corner of the auto industry. Dealers install them in your car before you ever see the vehicle, then try to sell you the subscription afterward. Say no and the hardware still stays put. According to researchers at the University of California San Diego, KARR systems are installed in about 2.2 million American vehicles, and around half of owners don’t even know they’re there.
The research team, led by computer science professor Aaron Schulman, investigated the system and found a single design flaw repeated across nearly a decade of installations.
Every KARR device shares the same authentication key, and it’s stored in plain text inside the KARR smartphone app. Extract it once and you can communicate with any KARR-equipped vehicle made since 2017. That is what the researchers did.
