2 million cars at risk of sneaky Bluetooth hack that unlocks doors
Popular Science...
A security vulnerability affecting at least two million vehicles on the road today is so serious that some cybersecurity experts are calling it one of the worst car-hacking threats in years. It involves a third-party, aftermarket device called the KARR Security System. When exploited, the threat potentially gives attackers a way to wirelessly unlock a vehicle’s doors or prevent it from starting.
While Acrisure Protection Group has issued a software update to fix the issue, many drivers who have the device hooked up to their car never paid for it and may not even know it’s installed. The device was installed in several models from major car brands, including Honda, Toyota, Mazda, Ford, and Jeep, though many of those automobiles have since spread to other states and even as far as Canada and Japan.
The compromised device was initially sold as an anti-theft tool for car dealerships. In a twist of irony, the device actually makes it theoretically easier for a thief to surreptitiously make off with someone else’s car. Researchers from the University of California, San Diego (UCSD) demonstrated that with a custom-built app, they could ping the device wirelessly over Bluetooth. With a few clicks, they could lock or unlock the doors, honk the horn, flash the headlights, or even prevent the car from starting if the engine was already off.
Acrisure Protection Group reportedly learned of the vulnerability from the researchers in January 2025, but only issued a software patch on July 20, 2026. When Popular Science reached out to Acrisure for comment we received a statement from KARR Security, a product line of the company responsible for making the device with the vulnerability.
Karr Security told Popular Science it has not seen the vulnerability applied in the real world to break into or steal a car.
“Researchers at UC San Diego identified a vulnerability affecting BLE-based auto theft devices, including a small percentage of KARR devices with certain Bluetooth-related components,” KARR Security said. “The vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions.”
“Nevertheless, we responded promptly and developed a firmware update to address the issue,” they continued.
The hack notably doesn’t start the car’s engine, meaning a thief can’t drive off using nothing but their phone. However, the UCSD researchers demonstrated that once inside, a carjacker could use “locksmith key-cloning tools” available on the internet to extract the key from a car’s computer and use it to start the ignition. The worst-case scenario is someone stealthily entering the car using the Bluetooth hack and quietly making off with it, without ever having to break a window or shimmy a lock. These actions could potentially set off an alarm or draw attention.
“Instead of smashing a window to get access to a vehicle, thieves could simply connect remotely via Bluetooth device inside the vehicle, and make it unlock car doors,” UCSD masters recipient Jerry Yu said in a blog post. Yu and the rest of the team behind the research are planning to present their research at this year’s Defcon cybersecurity conference in early August.
Stefan Savage, a UCSD computer science professor not involved with this research, told Wired this week that the KARR security flaw is “probably the worst” car hacking threat he’s ever seen.
An ant-theft tool becomes a stealthy way in
The KARR device looks like a small blinking button located on the bottom of the driver-side dashboard. It connects to the car’s computer system that controls key security functions. That device then connects to a smartphone app over Bluetooth. The idea is that a dealership installs these devices primarily as a means to help keep track of inventory and prevent theft from the lot. Once the car is sold, the dealership then tries to sell access to the device to the new driver as a paid add-on. Some percentage of drivers will say yes, and then access the tool using KARR’s consumer smartphone app. Those drivers should receive an alert on the app telling them to update the software with the fix immediately.
But many drivers chose not to pay for the service. Even if they don’t actively use the device, it’s often still physically there, hooked up to the car’s computer and ignition system, and still susceptible to the vulnerability. Drivers who purchased these cars on the secondary market sometime in the past nine years also may have no idea they’re even driving a compromised car. Many of the cars with the device installed will have a “KARR” sticker on the driver-side window or a sticker reading SWDS (short for Southwest Dealer Services). Concerned drivers can also look for a small blinking button attached to the underside of the car’s dashboard. That said, it’s unwise to simply rip the device out. Since it’s connected to an important system, removing it incorrectly risks creating even worse problems.
“Many car owners don’t even know that their vehicle is vulnerable,” UCSD Department of Computer Science and Engineering professor and study senior author Aaron Schulman said in a blog post. “So we wanted to make sure they were aware by publishing this study.”
One key to hack them all
The hack is made possible by a vulnerability in a single authentication key shared across all KARR devices. Every device used the same key, which the researchers compared to essentially a password reading “1234.” Once a researcher (or a hacker) gained access to one device, they essentially had the keys to all of them. Breaking into one device, in other words, meant breaking into them all. The researchers were able to reverse-engineer the KARR smartphone app’s code and use their own malicious app to connect to the device over Bluetooth, accessing it as if they were the car’s legitimate owner. With this method, the UCSD researchers unlocked car doors, honk the horn, and flash headlights.
In its statement, KARR Security emphasized that proposed hack requires a good deal of technical understanding to pull of and said the patch should fix the issue. Making sure that all two million-plus drivers impacted receive the update (or even know to look for it) is much more complicated. There are some steps concerned drivers can take. If they notice the sticker or can find the device, they should download the app and check for the update.
Acrisure also said it hopes to alert other drivers who may not know they have the compromised device via “dealer communications,” though it’s not entirely clear what that means.
“Active customers may apply the update directly from their phone after securely logging in to the KARR Security app,” KARR Security told Popular Science. “Vehicle owners of non-active systems can still update via the app using their VIN (last 8 digits) as a validation step.”
“This update needs to be installed even if you are a vehicle owner who didn’t activate the system when you bought your car at the dealership,” Schulman said in a YouTube video breaking down the research.
Cars are essentially computers now, for better or worse
Security researchers have been warning about a vulnerability like this occurring for the better part of a decade. As modern cars continue to integrate more of their core systems with computers, they are increasingly vulnerable to the same types of attacks software companies protect against on laptops and mobile devices. Increasingly connected cars are becoming what some call “smartphones on wheels.” That’s an advantage for car manufacturers, who can then charge drivers to activate certain features like heated seats, autonomous parking, and even extra EV horsepower for a subscription price. And all of this is made possible by over-the-air software updates. However, that constant digital back-and-forth also opens up more avenues for hackers to find a way in.
That change isn’t all negative though. Over-the-air updates mean car manufacturers can issue fixes for minor issues much faster than. Today, cars can undergo a massive recall and then have that recall fixed in a matter of hours or days, without the driver ever having to go into a shop. That constant, proactive fixing can prevent more significant issues down the line. Drivers also have more choice—or at least the appearance of choice—in the types of accessories and add-on features they choose to pay for.
Still, all of that comes with an unavoidable tradeoff. For better or worse, modern cars are just another internet-connected device, which means people have to get in the habit of regularly updating their cars, just like they would with all the other tech on their desks.
The post 2 million cars at risk of sneaky Bluetooth hack that unlocks doors appeared first on Popular Science.