Full Report
This is disturbing: …a team of security researchers at UC San Diego, who found that a model of aftermarket car alarm known as the KARR Security System, installed in more than 2 million vehicles across the US by their estimate, can let any hacker within Bluetooth range send radio commands to silently unlock the car at will, turn off its alarm, honk the car’s horn or flash its lights, or even disable its ignition and leave a driver stranded.
Analysis Summary
# Vulnerability: Remote Command Execution and Ignition Disablement in KARR Security Systems
## CVE Details
- **CVE ID**: Not explicitly listed in the provided text (Research attributed to UC San Diego).
- **CVSS Score**: Estimated 8.0 - 9.0 (High/Critical)
- **CWE**: CWE-287 (Improper Authentication), CWE-300 (Channel Accessible by Adversary)
## Affected Systems
- **Products**: KARR Security System (Aftermarket Car Alarm/Anti-theft device).
- **Versions**: Primarily the Bluetooth-enabled models (Reported to be installed in ~2 million vehicles).
- **Configurations**: Vehicles equipped with the dealer-installed KARR aftermarket security modules.
## Vulnerability Description
The KARR Security System utilizes Bluetooth Low Energy (BLE) for communication between the user's smartphone/fob and the vehicle control module. Researchers found that the system fails to properly authenticate radio commands sent over Bluetooth. This allows an unauthorized actor to spoof the legitimate controller and transmit unauthenticated commands directly to the vehicle's aftermarket hardware. Because this hardware is integrated into the vehicle's electrical system, it can intercept and manipulate critical functions including door locks, alarms, and the ignition starter kill circuit.
## Exploitation
- **Status**: PoC available (demonstrated by UC San Diego researchers).
- **Complexity**: Low (requires basic Bluetooth sniffing/transmission tools).
- **Attack Vector**: Adjacent (Within Bluetooth range, typically ~30-100 feet).
## Impact
- **Confidentiality**: Low (Information about vehicle status may be exposed).
- **Integrity**: High (Unauthorized commands to unlock doors or disable alarms).
- **Availability**: High (Ability to engage the "starter kill" feature, leaving the driver stranded and the vehicle inoperable).
## Remediation
### Patches
- **Firmware Update**: SWDS (Southwest Data Systems), the manufacturer of KARR, has reportedly issued a patch. Users should contact their local car dealership to verify if a firmware update is available for their specific module.
### Workarounds
- **Physical Disconnection**: If a patch cannot be applied, the primary workaround is to have a technician physically bypass or remove the aftermarket KARR module from the vehicle's ignition harness.
- **Bluetooth Disabling**: Limit the use of the mobile app and rely on physical keys, though this may not prevent a hacker from interacting with the vehicle's always-on receiver.
## Detection
- **Indicators of Compromise**: Unexpected behavior of door locks, horn honking, or flashing lights without user input; sudden inability to start the vehicle despite a healthy battery.
- **Detection Methods**: Monitoring for unauthorized or high-frequency BLE pairing attempts or command packets near the vehicle using Bluetooth signal analysis tools (e.g., Ubertooth, Wireshark).
## References
- **Schneier on Security**: hxxps[://]www[.]schneier[.]com/blog/archives/2026/08/vulnerabilities-in-car-anti-theft-device[.]html
- **Wired Magazine**: hxxps[://]www[.]wired[.]com/story/a-device-hidden-in-cars-across-the-us-leaves-them-vulnerable-to-hacking-and-paralysis-patch-it-now/
- **Research Credit**: University of California, San Diego (UCSD) Security Research Team.