A dealer-installed car alarm in 2 million US vehicles can be hacked to unlock, track, and disable them

2 Million US Cars Carry a Dealer-Installed Alarm That Can Be Hacked to Unlock Them

Car dealers across the United States wired a third-party alarm called the KARR Security System into more than 2 million vehicles, by the researchers' estimate. The device, sold by Acrisure Protection Group, was meant to stop theft on dealer lots. Instead, security researchers at UC San Diego found that it uses a single authentication key shared across every unit. Anyone within Bluetooth range can silently unlock the car, kill the ignition, or trigger horns and lights across multiple vehicles at once 1.

Most owners never bought the device and have no idea it is in their car. Dealers install the KARR alarm as anti-theft protection for their own inventory. When the car sells, the alarm stays, even when the buyer declines to pay for it. UCSD estimates at least half of affected drivers never asked for the device to be there 1.

This is the security paradox at the core of the story. The product marketed as protection became the attack surface. And unlike a phone vulnerability, there is no over-the-air update arriving overnight. Owners must first check for visible signs of the device, such as a sticker or blinking button under the dashboard, then download an app, connect via Bluetooth, and manually trigger the patch 1.

The root cause is straightforward: every KARR alarm shares the same authentication key. Once researchers extracted that key from the device's code, they built an Android app that scans for nearby vehicles with KARR installed, lists them by their Bluetooth signals, and sends commands with a tap. The exploits unlock doors, disable the alarm, honk the horn, flash lights, or cut the ignition 1. The vulnerability does not let an attacker start the engine. But the researchers showed that once inside, a locksmith tool commonly sold online can create a working key in minutes 1.

Aaron Schulman, the UCSD computer science professor who led the research, put the contradiction plainly: "It's designed to make cars more secure, but ultimately it's created a vulnerability that needs to be patched immediately across millions of vehicles" 1.

His UCSD colleague Stefan Savage, who co-led the first team to hack a car's steering and brakes in 2010 and 2011 but was not involved in the KARR findings, called it "probably the worst" car hacking threat ever discovered. His reasoning: the number of vehicles is massive, the car's manufacturer cannot fix a device they did not install, and the owner does not know it exists 1.

That disconnection is what turns a software bug into a structural failure. Carmakers have no record of which vehicles carry KARR. Dealers installed the device at the lot, not the factory. When a car is resold, the new owner inherits the alarm with no paperwork. Acrisure Protection Group has not explained how it will reach secondhand owners who cannot be contacted through dealerships 1.

The company's response invites skepticism. A spokesperson told WIRED the vulnerability is "highly complex" and "presents a low risk to customers under real-world conditions." Yet researchers demonstrated the attacks using nothing more than a phone within Bluetooth range. Acrisure also said it responded promptly, though nearly 18 months passed between UCSD's initial disclosure in January 2025 and the patch, which arrived just weeks before the researchers' scheduled presentations at the Defcon hacker conference and the Usenix security conference 1.

If you want to check your car, look for a sticker on the driver-side window reading "KARR" or "SWDS," or a small button with a blinking light under the dashboard. Southern California drivers are most likely to have one, though researchers have found the devices across the US and in other countries. To patch it: download the KARR Security System app (Android or iOS), connect to your vehicle, then navigate to "customer service" and "firmware update" 1.

Two million cars are running hardware their owners never requested, protected by a shared key that any nearby phone can exploit. The question is not whether the automotive aftermarket will produce another vulnerability like this. It is whether anyone is watching for it.