In the age of smart vehicles—modern cars have transformed into multi-ton computers on wheels. As a result, drivers must stay updated with security patches for their vehicle software, just like they do for their smartphones and laptops. However, even tech-savvy car owners may not anticipate needing to install updates for potentially insecure third-party components embedded within their vehicles. These vulnerabilities can leave vehicles exposed to stealth hacking, unauthorized tracking, and even complete immobilization.
A recent study by security researchers at the University of California, San Diego, revealed a concerning flaw in the KARR Security System, an aftermarket car alarm reportedly installed in over 2 million vehicles across the nation. This vulnerability allows hackers, when within Bluetooth range, to send covert commands that can unlock cars, silence alarms, sound horns, flash lights, or even disable ignitions, leaving drivers stranded.
Typically installed by car dealerships rather than manufacturers or consumers, KARR alarms are meant to deter car theft from dealership lots. However, when a vehicle is sold, the alarm system often remains, even if the buyer did not opt for it. Consequently, countless car owners unknowingly possess hackable devices within their vehicles, necessitating software updates for security, yet many may be entirely unaware of their existence.
“This is a system that was added to cars by dealers, and unfortunately, it possesses significant vulnerabilities allowing unauthorized access,” remarked Aaron Schulman, a UCSD computer science professor who led the study. “While intended to enhance vehicle safety, it ultimately creates risks that demand urgent patching across millions of cars. We urge everyone to verify whether their vehicle is fitted with this device and to manually implement patches promptly.”
Acrisure Protection Group, the distributor of KARR security systems, has announced a firmware update for vulnerable Bluetooth models of the KARR alarm to address the security issue identified by UCSD. Car owners with the KARR Security smartphone app should receive a firmware update notification. If you haven’t yet installed the app, please download it from the Google Play Store or the Apple App Store. Connect to your vehicle’s KARR alarm and select “Customer Service” followed by “Firmware Update.”
With UCSD estimating that at least half of car owners with KARR devices did not request them, you can check for a KARR sticker on your driver’s side window or locate a small button with a flashing light under your dashboard. The use of KARR devices is particularly prevalent among Southern California car dealerships, yet UCSD researchers are finding this system installed in vehicles across the U.S. and even internationally.
Source: www.wired.com