Anyone in Bluetooth Range Can Unlock Cars, Kill Engines Through Alarms Owners May Never Have Paid For - The Drive

What the report says

The Drive reports that a vulnerability in dealer-installed Karr alarm systems could expose vehicles to unauthorized Bluetooth commands, potentially allowing someone nearby to unlock doors, disable ignition functions or trigger other controls. The systems are installed in roughly 2 million vehicles in the United States, according to the report, and some owners may not know the hardware is present because dealers may leave it installed even when a buyer does not subscribe to the service.

The issue was identified by researchers at the University of California San Diego and reported by Wired, which The Drive cited. Karr has released a firmware update meant to fix the flaw, and The Drive says it can be applied through a companion smartphone app available to paying and non-paying users. Karr told Wired the vulnerability was complex and low-risk in real-world conditions, while saying it had developed an update. The Drive noted the patch reportedly came about 18 months after notification.

The article says vehicles with Karr equipment may have “Karr” or “SWDS” stickers on the driver-side window, though owners with concerns are advised to contact their dealer. The Drive also reported that Karr works with more than 3,000 dealers, some of which use the systems to track inventory before sale and then offer customers paid security features afterward.

The matter highlights a broader connected-car risk: hardware installed for dealership operations can remain active after purchase, even if the buyer did not request it. The Drive argues that dealers should be required to remove such alarms unless customers explicitly agree to keep them.