![\"A](\"https:\/\/www.newsbeep.com\/us-ca\/wp-content\/uploads\/2026\/07\/5277342.webp\")
<\/p>\nsecurity<\/p>\n
Aftermarket dealer-installed KARR\/SWDS security systems all use the same secure key, say UCSD researchers<\/p>\n
At least 2.2 million vehicles fitted with dealer-installed KARR and SWDS security systems are vulnerable to nearby Bluetooth attacks that can unlock doors or prevent a stopped vehicle from starting, according to researchers at the University of California San Diego.<\/p>\n
<\/p>\n
\n A KARR security system sticker in a vehicle window
\n David Baillot\/UC San Diego Jacobs School of Engineering\n <\/p>\n
An advance look<\/a> at the research published by UCSD this week (the full writeup<\/a> won\u2019t be available until August 12) reveals that KARR and SWDS security devices manufactured by Acrisure contain a serious flaw: They \u201call \u2026 rely on the same secure key,\u201d the researchers found.\u00a0<\/p>\n What that means, according to the researchers, is that anyone who knows the key, has a device with a Bluetooth connection, and can get within five yards of an affected vehicle can unlock it, make the horn honk, flash the headlights, or even prevent it from starting.\u00a0<\/p>\n \u201cInstead of smashing a window to get access to a vehicle, thieves could simply connect remotely via Bluetooth to the device inside the vehicle, and make it unlock car doors,\u201d Jerry Yu, coauthor on the research and UCSD compsci graduate, said in the release.\u00a0\u00a0<\/p>\n KARR\/SWDS devices<\/a> are installed by dealerships. Along with providing key fob-like functions, they also serve as an antitheft device, allowing dealers and buyers to track cars with the devices installed in the case of theft. <\/p>\n According to UCSD, the devices are typically sold as a paid upgrade at dealerships around the US. KARR says its products are available through more than 3,000 dealerships nationwide. Per the researchers, however, those devices remain active even if a buyer declines the service, meaning those who don\u2019t have an active KARR\/SWDS contract are still at risk.\u00a0<\/p>\n \u201cRemoving the devices is not trivial,\u201d UCSD compsci PhD candidate and paper co-author Yibo Wei said in the university\u2019s report on the research. \u201cYou have to open up the dashboard and cut and reconnect the wires that are deeply intertwined with the car\u2019s computers and ignition system.\u201d\u00a0<\/p>\n In other words, there are likely a lot of cars on the road with one of these units installed, and for many owners, a KARR or SWDS window sticker may be the only obvious indication.<\/p>\n The researchers said that most vulnerable vehicles were purchased in Southern California in the past nine years from Honda, Toyota, Mazda, Ford, and Jeep dealerships. Secondary market resales, however, mean affected vehicles can be found throughout the US and even as far away as Japan, the team noted. They also discovered a public database that stores information about equipped vehicles, according to UCSD.<\/p>\n For those worried their vehicle may be vulnerable, no need to worry: KARR Security has already released a firmware update for affected devices that can be installed by both active customers and those with an inactive security system;\u00a0steps<\/a> are included on the company\u2019s website. It\u2019s not clear if KARR is notifying customers of the need to update their security system – we asked, but the company didn\u2019t directly respond to that question.\u00a0<\/p>\n What KARR did tell us was that, in contrast to the UCSD finding that \u201call KARR-SWDS devices rely on the same secure key,\u201d it claims that only a small percentage of devices \u201cwith certain Bluetooth-related components\u201d are actually affected.\u00a0<\/p>\n \u201cThe vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions,\u201d a KARR spokesperson told us. \u201cNevertheless, we responded promptly and developed a firmware update to address the issue.\u201d\u00a0<\/p>\n