Millions of Cars Left Trackable, Unlockable

A coding error in a popular aftermarket car alarm has left millions of vehicles open to remote unlocking, ignition disabling, and covert location tracking. The device, KARR Security System from Acrisure Protection Group, is typically installed by dealerships before customers ever pick up their cars, often without their knowledge.

Researchers at UC San Diego, led by professor Aaron Schulman, found that every KARR unit uses an identical authentication key, stored unencrypted inside the companion smartphone app. Once extracted, that single key can be used to communicate with any KARR-equipped vehicle sold since 2017 — an installed base estimated at roughly 2.2 million vehicles, about half of whose owners don't even know the hardware exists.

From within a few yards of a car, the researchers showed it's possible to unlock the doors or kill the ignition using only a brief Bluetooth command, with no alert reaching the driver beyond a faint beep and light flicker. Because the devices constantly broadcast Bluetooth signals, crowdsourced tracking databases have quietly logged years of location history for these cars, effectively enabling stalking. The team also demonstrated a "mayhem" mode capable of triggering horns and lights across several parked vehicles simultaneously.

Acrisure was notified of the vulnerability in January 2025 but didn't ship a firmware fix until July 2026 — about eighteen months later, and just weeks before the findings were due to be presented at DEF CON. The company has downplayed the real-world danger. That timeline contrasts sharply with Subaru's swift 24-hour patch last year for a comparable connected-car weakness in its Starlink platform.

The bigger problem is distribution: the fix only reaches drivers through the KARR app, which non-subscribers never downloaded. That leaves roughly a million owners unable to patch a vulnerability they don't know they have. Drivers are advised to check for a KARR or "SWDS" sticker and a blinking dashboard button, then install the app regardless of whether they ever signed up.