Full Breakdown
Karr Alarm Vulnerability Exposes Cars to Bluetooth Hijacking
7/22/2026, 12:24:48 AM
Scope of the Issue and Dealer Practices
Karr Security Systems supplies aftermarket alarm and tracking hardware that is installed in an estimated two million U.S. vehicles. More than 3,000 dealers partner with Karr, often fitting the devices on inventory cars for loss-prevention purposes. When a vehicle is sold, the dealer may offer the alarm as an optional paid service, but the hardware frequently remains active even if the buyer declines to pay. The system’s Bluetooth radio stays powered for about ten minutes after the engine is shut off, creating a window in which any nearby device could communicate with the car.
Technical Vulnerability Discovered by Researchers
Researchers at the University of California, San Diego identified a flaw that allows a malicious actor within Bluetooth range to send commands that can unlock doors, disable the ignition, and trigger other alarm functions. Demonstrations showed that the exploit works on Karr-equipped cars that have not received the latest firmware, requiring only the appropriate software and proximity to the vehicle.
Official Response and Firmware Update
A Karr spokesperson told Wired that the vulnerability is “highly complex” and poses a low risk under typical conditions. The company said it responded promptly by releasing a firmware update that can be installed through a companion smartphone app, which is available to both paying subscribers and non-subscribers. The update was issued roughly 18 months after the researchers first reported the flaw.
Expert Criticism and Security Concerns
UC San Diego faculty described the issue as “probably the worst” car-hacking threat identified to date, arguing that the ease of exploitation outweighs the company’s low-risk characterization. Security experts highlighted that the continued presence of unused alarm hardware expands the attack surface for modern connected cars.
Potential Remedies and Future Outlook
Commentators have suggested that legislation requiring dealers to remove optional alarm systems unless the buyer explicitly consents could mitigate the risk. Until such policies are enacted, owners are advised to verify whether their vehicle carries Karr equipment—often indicated by “Karr” or “SWDS” stickers on the driver-side window—and to apply the available firmware update.
