Millions of Vehicles Vulnerable to Remote Attacks via Flawed KARR Security System Researchers at the University of California, San Diego, have uncovered a critical Bluetooth vulnerability in the aftermarket KARR Security System, exposing an estimated 2.2 million vehicles to remote attacks. The flaw allows unauthorized access to key functions, including door unlocking, alarm deactivation, and engine immobilization, though it does not enable remote driving control. The vulnerability stems from a hardcoded authentication key embedded in all KARR devices. By reverse-engineering the official KARR mobile app, researchers extracted this universal key and developed a proof-of-concept Android app capable of impersonating legitimate users. Attacks can be executed within Bluetooth range, making the exploit scalable across all affected systems. The KARR system is commonly installed by dealerships as a theft deterrent for vehicles on their lots, but the hardware often remains in place even if buyers opt out of the service. Many owners are unaware their vehicles are equipped with the system, which continues to emit Bluetooth signals regardless of activation status. Researchers mapped vulnerable vehicles across the U.S. using WiGLE radio signal data, detecting nearly 100 KARR-equipped vehicles during a short drive near San Diego. Beyond active exploitation risks, the system’s persistent Bluetooth emissions raise privacy concerns, as historical signal data could reveal vehicle movement patterns. Acrisure Protection Group, the parent company of KARR, released a firmware patch on July 20, 2025, following responsible disclosure in January. However, mitigation is complicated by the system’s aftermarket nature traditional over-the-air updates or manufacturer recalls do not apply. Owners must manually check for KARR hardware (often labeled on windows or under the dashboard) and install the update via the KARR app. The incident highlights a broader issue in automotive cybersecurity, where third-party hardware can bypass manufacturer security controls, leaving consumers and automakers with limited visibility and delayed response options.