UC San Diego Researchers Find Bluetooth Flaw in Dealer-Installed KARR and SWDS Car Alarms, Exposing 2.2 Million Vehicles

Overview

At least 2.2 million vehicles fitted with dealer-installed KARR and SWDS anti-theft devices are vulnerable to Bluetooth attacks that can unlock doors, sound the horn, flash the lights, or stop a parked car from starting, according to researchers at the University of California San Diego, cited by The Register. The flaw traces to a design choice: the devices, the researchers found, “all … rely on the same secure key,” as reported by The Register.

What We Know

• Vulnerable vehicles display a “KARR” or “SWDS” sticker on the driver’s-side window and were primarily purchased at Honda, Toyota, Mazda, Ford, and Jeep dealerships in Southern California between 2017 and today, according to UC San Diego. Several hundred thousand more vulnerable vehicles have spread nationwide and to Canada and Japan through the used-car market, UC San Diego said.
• The devices are aftermarket, Bluetooth-enabled anti-theft units that dealerships install to manage inventory and deter theft, according to UC San Diego. They are manufactured by Acrisure Protection Group, according to Malwarebytes; UC San Diego noted that Rockledge, a car security and insurance company, makes similar devices.
• An attacker within roughly five yards of a targeted vehicle can connect to the device over Bluetooth and unlock doors, honk the horn, flash headlights, or prevent a stopped car from starting, according to UC San Diego and The Register. The system’s Bluetooth radio stays on for 10 minutes after the car has been turned off, according to The Drive.
• The devices also continuously broadcast Bluetooth identifiers, meaning crowdsourced radio-mapping databases such as WiGLE have been logging their locations for years, according to Malwarebytes. When a command is sent to a device, the only outward sign is a brief beep and a light flicker, and the owner receives no alert, Malwarebytes reported.
• UC San Diego computer science graduate Jerry Yu, a coauthor of the research, said: “Instead of smashing a window to get access to a vehicle, thieves could simply connect remotely via Bluetooth to the device inside the vehicle, and make it unlock car doors,” according to UC San Diego.
• Removing an affected device isn’t a simple fix. PhD student and coauthor Yibo Wei said, “Removing the devices is not trivial. You have to open up the dashboard and cut and reconnect the wires,” according to The Register.
• Professor Aaron Schulman of UC San Diego’s Department of Computer Science and Engineering, who led the research, said: “Many car owners don’t even know that their vehicle is vulnerable. So we wanted to make sure they were aware by publishing this study,” according to UC San Diego. One UC San Diego professor involved in the research called the flaw “probably the worst” car-hacking threat found to date, according to The Drive, though the outlet did not name which professor made the remark.
• The researchers stumbled onto the vulnerability while investigating credit card skimmers, according to UC San Diego. Alongside Yu, Wei, and Schulman, the research team includes Sumanth Rao, Mohak Vaswani, Jefferson Chien, alumnus Nishant Bhaskar, and Christian Dameff of UC San Diego Health, the university said.
• UC San Diego disclosed the flaw to Acrisure in January 2025, but a firmware fix did not arrive until July 20, 2026 — about 18 months later, according to Malwarebytes. The fix must be downloaded through the KARR smartphone app, according to UC San Diego, and Malwarebytes reported that roughly a million affected owners are unlikely to know the app or the underlying device exists, writing: “Roughly a million people cannot patch what they do not know exists.”
• A KARR spokesperson told The Register that “the vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions,” and said only “a small percentage of devices ‘with certain Bluetooth-related components’ are actually affected,” according to The Register.
• The researchers plan to present their full findings at DEF CON in Las Vegas on August 9 and at the USENIX Security conference in Baltimore on August 12, according to UC San Diego and The Register.

What We Don’t Know

• Neither UC San Diego nor the outlets covering the research cited a CVE identifier for the flaw.
• It is unclear how many of the 2.2 million affected vehicles have already applied the July 20 firmware update, or how Acrisure plans to reach owners who never registered for the KARR service.
• Rockledge has not said whether its similar devices share the same vulnerability, and the research team’s full technical paper — to be presented at DEF CON and USENIX Security in August — has not yet been published.

Analysis

The episode underscores a recurring weak point in aftermarket vehicle security: devices installed by dealerships, rather than automakers, often sit outside the update and disclosure practices that govern factory-fitted systems. Researchers’ own recommendation — requiring a physical button press inside the car before a new phone can pair with the device, according to UC San Diego — is a low-tech mitigation for a problem created by a single shared cryptographic key spread across millions of units. The fact that the fix ships only through an app most owners never installed illustrates how a security feature marketed to deter theft can become, in Yu’s words, an entry point instead of a deterrent.