A Device Hidden in Cars Across the US Leaves Them Vulnerable to Hacking and Paralysis. Patch It Now - WIRED

What the report says

Wired reports that security researchers at the University of California San Diego found serious vulnerabilities in the KARR Security System, an aftermarket car alarm installed by dealerships in an estimated more than 2 million vehicles in the United States. The researchers said the Bluetooth-enabled devices can be targeted from nearby to unlock a vehicle, silence its alarm, trigger lights or horns, track the device’s presence, or prevent the ignition from working, potentially leaving a driver unable to start the car.

According to Wired, the alarms are often fitted by dealers to protect cars on lots and may remain in vehicles after sale even when buyers decline the paid add-on. That means some owners may not know the system is installed. UCSD researchers said affected drivers may be able to identify it by a KARR or SWDS sticker, or by a small blinking button under the dashboard. The devices are reported to be especially common in Southern California but have been found more widely.

Acrisure Protection Group, which sells KARR, told Wired the issue is complex and low risk in real-world conditions, but said it has released a firmware update. Wired reported that owners with the KARR Security app should receive an update notice; others may need to install the app, connect it to the vehicle’s KARR alarm, and use the customer service firmware update option.

The disclosure matters because the flaw involves a third-party component outside the automaker’s normal update process. Wired said UCSD notified the company in January last year, with a fix arriving ahead of planned research presentations at Defcon and Usenix.