Researchers at the University of California San Diego (UCSD) have identified a critical vulnerability in KARR and SWDS aftermarket security systems, which could allow attackers to remotely unlock vehicles or prevent them from starting. These systems, manufactured by Acrisure, are installed by dealerships and are present in at least 2.2 million vehicles.
The core of the vulnerability, according to the UCSD researchers, is that all KARR and SWDS devices utilize the same "secure key." This shared key means that anyone with knowledge of it, a Bluetooth-enabled device, and proximity within five yards of an affected vehicle could exploit the flaw. Potential actions include unlocking doors, sounding the horn, flashing headlights, or disabling the vehicle's ignition.
KARR, however, disputes the claim that all devices share the same key, stating that only a "small percentage" of devices with specific Bluetooth components are affected. A spokesperson for KARR described the vulnerability as "highly complex" and presenting a "low risk to customers under real-world conditions," but confirmed that a firmware update has been developed and released.
The KARR/SWDS systems are typically offered as paid upgrades at dealerships nationwide, with KARR reporting availability through over 3,000 dealerships. The UCSD team noted that even if a buyer declines the service, the devices often remain active in the vehicle, leaving owners vulnerable regardless of an active contract. Removing the devices is not a simple task, requiring significant disassembly of the dashboard and manipulation of wiring connected to the car's computer and ignition.
Most of the vulnerable vehicles were purchased in Southern California over the past nine years, primarily from Honda, Toyota, Mazda, Ford, and Jeep dealerships. However, due to secondary market sales, affected vehicles can be found across the United States and even internationally, including Japan. The researchers also discovered a public database containing information about equipped vehicles.
The vulnerability was discovered serendipitously by the UCSD team while researching credit card skimmers, when they identified unknown Bluetooth fingerprints that led them to investigate car security systems. The researchers, including Jerry Yu and Yibo Wei, are scheduled to present their findings at DEF CON on August 9 and the USENIX Security conference on August 12.
KARR has released a firmware update to address the issue, which is available to both active customers and those with inactive security systems. Instructions for installation are provided on the company's website. It is not clear whether KARR is actively notifying customers about the need for this update.
