Millions of vehicles in the U.S. are susceptible to theft due to a flaw in aftermarket anti-theft devices that allows attackers to remotely unlock doors and disable ignitions. Researchers at the University of California San Diego identified the vulnerability, which affects vehicles originally sold by Honda, Toyota, Mazda, Ford, and Jeep dealerships, primarily in Southern California between 2017 and the present.
The issue stems from KARR and SouthWest Dealer Services (SWDS) anti-theft devices, which are installed under the dashboard. These devices connect to a smartphone app via Bluetooth, enabling owners to control locks, the horn, headlights, and ignition. However, researchers discovered that all affected devices share the same digital security key, a weakness likened to using a universally weak password that cannot be changed.
Once this shared key is extracted from the official app, it can be used to send commands to any vulnerable vehicle within Bluetooth range, approximately 15 feet. Dealerships sometimes install these devices and leave them active even if buyers decline the associated paid security service, meaning many owners may be unaware their car is vulnerable.
Owners can identify potential vulnerability by looking for a KARR or SWDS sticker on the driver-side window or a small blinking button beneath the dashboard. The flaw does not permit remote starting of a vehicle or control of a moving car. However, a silently unlocked door significantly lowers a major hurdle for car thieves. Once inside, criminals could use locksmith tools to create a new key within minutes, enabling them to start the engine and drive away.
The security systems were initially designed to help dealerships manage inventory and deter theft on sales lots. Researchers began investigating these systems in 2018 after observing unusual Bluetooth signals. They traced these signals to devices manufactured by Acrisure and Rockledge, with Rockledge devices potentially having a separate, though more difficult to exploit, vulnerability.
Acrisure has since released a firmware update to address the KARR-SWDS flaw. However, this update is not automatically delivered through car manufacturers like Honda, Toyota, Mazda, Ford, or Jeep. Affected owners must download and install the latest firmware themselves via the KARR app. Those unable to identify or update their system are advised to contact the selling dealership or KARR customer support. Researchers caution against attempting to remove the hardware independently, as it is deeply integrated with the vehicle's internal systems.
To mitigate risks, drivers who find evidence of a KARR or SWDS system should open the official KARR Security app, connect to the device, and install the latest firmware. The researchers have withheld technical details of the exploit to prevent misuse and have reported the vulnerabilities to manufacturers, vendors, and the National Highway Traffic Safety Administration. They also suggest that future Bluetooth security systems should incorporate an in-vehicle button press before new smartphone connections are permitted.