News

Millions of cars carry a Southern California dealer alarm with a security flaw

Most of the 2.2 million affected cars were sold at Southern California dealerships, but resale carried several hundred thousand of them everywhere else. Two minutes tells you whether yours is one.

Researchers at UC San Diego found that at least 2.2 million cars on the road today carry a dealer-installed Bluetooth alarm, and every one of those alarms answers to the same key. From about five yards away, someone holding that key can unlock the doors, shut off the alarm, honk the horn, or keep a parked car from starting. The device is called KARR. Most of the cars carrying one were sold at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California from 2017 on.

Every KARR unit relies on the same secure key, so cracking it once gets you all of them. Picture an apartment building where every unit takes the same key and none of the locks can be rekeyed.

Not what you signed up for

Dealers install KARR across their inventory to keep track of cars sitting on the lot. When one sells, the alarm and its app get offered at the finance desk as a paid upgrade. Turn it down and the hardware usually stays in the car anyway, wired in under the driver's side of the dash. The UC San Diego team estimates at least half the owners with a device never asked for one. Aaron Schulman, the study's senior author, says many of them do not know it is in there at all.

Saying no does not switch it off either. The device stays active, and the car stays open to the attack.

The study counted at least 1.4 million vulnerable cars, then revised the estimate past 2.2 million. Used-car sales carried them well past California, with several hundred thousand scattered across the United States, Canada, and as far as Japan. Public databases that log Bluetooth signals have also recorded where these devices have been, so a car with one can be traced back to the places it parks. One more thing in your car is keeping track of where you go.

The fix

Acrisure, the company behind KARR, released a firmware update on July 20. Firmware is the software baked into the device itself, so this is the same kind of fix as every other patch you are told to install. The researchers reported the flaw in January 2025, which puts the turnaround at about eighteen months. KARR told Popular Science it has not seen the attack used against a real car, and called the vulnerability highly complex and low risk in real-world conditions.

The update does not arrive on its own. You download the KARR Security app, connect to the device over Bluetooth, and run the update yourself. Your car's manufacturer cannot push it out, because KARR is not their equipment.

So the fix depends on you knowing about a device nobody told you about, then installing the app for a service you already declined. Acrisure says it will notify owners through the app, its website, and its dealers. Two of those three only reach people who already know this exists. The dealership is the easy target here, but Acrisure sat on the report for eighteen months. A second manufacturer named in the same study, Rockledge, had not answered the researchers at all when they published.

The risk has real limits. Somebody has to be standing within a few yards of your car, and there is no evidence of this happening outside a lab. But the researchers point out that once a door is open, a thief can use ordinary locksmith tools to start the car and drive off, so "only the doors" is underselling the threat.

How to check your car

Check the driver's side window. A sticker reading 'KARR' or 'SWDS' means the car probably has one.
Look under the dash on the driver's side. A small button with a blinking light means you have one.
Update it if you find one. Download the KARR Security app, connect to the device, then 'Customer Service' and 'Firmware Update'. It is free whether or not you ever paid for the service.
Ask if you cannot tell. The dealer who sold you the car can look it up, and KARR lists customer service contacts at KARRsecurity.com.
Dig out your purchase paperwork. Look for line items reading 'KARR', 'SWDS', or 'theft protection', the ones you bought and the ones you declined. This step applies to every car, not just the ones with a sticker.

Most people reading this will check, find nothing, and be done in two minutes. If you live in Southern California, take a few extra minutes to confirm. There is a lesson to be learned: things get added to your car before you ever lay eyes on it, and saying no to the bill does not always mean saying no to the hardware. The robot vacuum in the living room is a similar story.