TLDR Tech / InfoSec
If you've got this dealer-installed car alarm, patch it today with your iPhone
UC San Diego researchers found that the KARR Security System, an aftermarket alarm dealerships often leave connected even after buyers decline the paid service, relies on a shared Bluetooth authentication key discovered inside the official app, letting anyone in range unlock, immobilize, or trigger the horn and lights on an estimated 2.2 million vehicles across Honda, Toyota, Mazda, Ford, and Jeep lots. The episode highlights a structural gap in automotive supply chains: because KARR is third-party hardware installed post-sale, the flaw sits outside automakers' normal patching pipelines, and researchers estimate at least half of affected owners never even requested the feature. It also underscores a secondary privacy dimension, since the same persistent Bluetooth broadcast used for the exploit can be mined from crowdsourced wireless databases like WiGLE to reconstruct a vehicle's movement history, a risk distinct from the unlock vulnerability itself.
Read the full story