Getting your
Trinity Audioplayer ready...An anti-theft system built to protect cars is actually making them easier to steal, UC San Diego researchers found.
Using just a smartphone, Aaron Schulman, associate professor at the University of California San Diego Jacobs School of Engineering, was able to leverage the security system’s Bluetooth connection to unlock the car and immobilize the vehicle from 5 yards away. The security system is manufactured by Carlsbad-based KARR, which provides dealer-installed anti-theft and GPS recovery systems for vehicles. Schulman estimates more than 2.2 million cars are equipped with the system.
Dealers pitch this system as an optional upgrade: Pay for the service and you can unlock your car with your phone and track it if it gets stolen. They are sold for $500 to $1,500 upon purchase of the car.
Even if one declines the upgrade, the vehicle can still be compromised, as many dealerships integrate the hardware in all of their cars to protect against theft on their own lots, Schulman said Tuesday.
“This car theft system was being installed in almost every car in almost every dealership in San Diego,” Schulman said. “Many people don’t know they have it in their cars.”
Most of the vulnerable vehicles were bought at Honda, Toyota, Mazda, Ford and Jeep dealerships in Southern California from 2017 to now and have a KARR sticker on the driver’s side window.
Some of San Diego’s largest dealerships — DCH Honda of Mission Valley, National City Toyota, Hello Mazda of San Diego, Carvana Chrysler Dodge Jeep Ram of San Diego — did not respond to requests for comment from the Union-Tribune.
On Monday, KARR released a patch for the problem. “We responded promptly and developed a firmware update to address the issue,” the company said in a statement to the U-T.
To fix the flaw, KARR owners have to update the device themselves. The company is offering a free firmware patch through its smartphone app: Drivers download the KARR security app, sit in the driver’s seat, turn the key to power the car on, tap through a few prompts on their phone, then turn the key off.
“It’s urgent that everyone manually update them,” Schulman said. The whole process takes about one to two minutes, he said, but every affected car has to be updated manually.
This vulnerability has existed for almost a decade, Schulman said, recalling when he first saw the Bluetooth signal in 2017.
“My students and I were actually looking for credit card scammers in gas pumps in San Diego, and we noticed this other Bluetooth signal that was really prevalent, but we couldn’t figure out what it was,” he said.
It wasn’t until 2024 “that we started to piece it all together — that this was actually this car theft system that was being installed in almost every car sold in many dealerships in San Diego,” Schulman said.
When Schulman first discovered this, he spent many sleepless nights debating whether to tell the world. At that point, he and his students were the only ones who knew how to unlock a car this way.
“It’s an extremely unsettling moment when you realize that you, as a researcher, found out how you yourself could be unlocking every single car in San Diego,” he said.
Schulman decided to call KARR’s customer service line and tell them a researcher had found a vulnerability they needed to solve. A few days later, KARR’s security team came down to UC San Diego to watch one of Schulman’s students hijack a car using KARR’s technology.
Schulman and the KARR team spent an hour “white-boarding what to do next,” Schulman said. “And actually, they implemented everything that we had talked about.”