How KARR Owners Should Respond to the Bluetooth Flaw

Yes. Affected, unpatched Bluetooth-enabled KARR and SWDS anti-theft devices are a documented security risk on an estimated at least 2.2 million U.S. vehicles. UC San Diego researchers demonstrated nearby commands that could unlock doors, disable the alarm, activate the horn or lights, and prevent a stopped vehicle from starting—the opposite of what the dealer-installed equipment was sold to do. The finding does not establish that every KARR installation or firmware version is vulnerable. UC San Diego describes the affected population and demonstrated commands.

A firmware update was released on July 20, 2026, but it requires owner action. If you have KARR or SWDS hardware and cannot confirm that update was completed, use the official update process or ask KARR, the selling dealer, or a qualified automotive electronics technician to verify and mitigate the installation. Turning off Bluetooth on your phone or deleting the app is not a confirmed fix because neither action establishes that the vehicle-mounted module has stopped broadcasting or accepting Bluetooth communication.

Match the marking and installation details from your car; the result identifies which response wins for your situation.

The Case for Dealer-Installed Security

The usual argument for a dealer-installed alarm is reasonable. Added intrusion sensing, remote locking, immobilization, location functions, and vehicle-recovery tools can supplement a car’s factory equipment. Dealers may also use installed systems to protect vehicles while they are held in inventory.

KARR is not one uniform product. Depending on the dealership program, hardware, vehicle, and model, a system may provide Bluetooth or cellular connectivity, alarm sensing, app-based locking, GPS tracking, geofence alerts, immobilization, or battery notifications. The vendor says feature availability varies by program and vehicle. KARR describes its available security-program features.

That consensus remains right in a limited sense: correctly designed, maintained, and authenticated security equipment can provide useful protection. The UC San Diego finding does not show that every KARR product is defective or that dealer alarms are inherently unsafe.

The problem is that the affected equipment reportedly used the same Bluetooth authentication key rather than a credential unique to each device or customer. Researchers found that key in the smartphone app’s code. A nearby device presenting the accepted credential could make an unauthorized command look legitimate to the units tested.

That authentication failure turns high-impact security functions into liabilities. A fault involving a dashboard light is an inconvenience; a fault involving door locks, an alarm, and an immobilizer can affect physical access and whether a parked car starts.

The Risk Is Demonstrated but Narrower Than Some Headlines Suggest

KARR owner Acrisure Protection Group says only a small percentage of devices containing certain Bluetooth-related components were affected. It describes exploitation as highly complex and the real-world customer risk as low. The company also said it had no confirmed reports of the vulnerability being exploited against a customer. CBS 8 reports the researchers’ findings, KARR’s response, and the update.

Those are meaningful limits. A demonstrated attack is not proof that attacks are common, and the cited evidence documents no confirmed theft or stalking incident caused by this flaw.

The public information also does not identify every affected model number, component, serial-number range, or firmware version. A KARR sticker is therefore a reason to investigate, not proof that a particular car remains vulnerable.

The researchers’ demonstrated capabilities were nevertheless consequential:

Function	Demonstrated Result	Key Limitation
Door locks	Unlock a nearby affected car	Did not start the engine
Alarm	Disable the alarm	Did not defeat every factory system
Horn and lights	Activate them	Did not control all electronics
Immobilization	Prevent the next start	Did not stop a running engine

The reported attack required proximity of approximately five yards, although practical Bluetooth range varies with obstructions, interference, antennas, and surroundings. This was not unrestricted control from anywhere on the internet. The Register explains the shared key, proximity requirement, and immobilization limit.

Unlocking the doors and silencing the alarm could make entry or theft of cabin property easier. The flaw did not directly start the vehicle; driving away would require another method to overcome the vehicle’s starting and factory immobilizer protections.

Likewise, “disable the engine” needs qualification. Researchers demonstrated preventing a stopped or parked vehicle from starting again. They did not demonstrate shutting down an engine that was already running.

Inactive Service Does Not Mean Inactive Hardware

Dealers may install KARR or SWDS equipment before a vehicle is sold, including for inventory protection. Researchers reported that some modules remained in vehicles when buyers declined or later deactivated the associated service.

Some of those units continued broadcasting and accepting Bluetooth communication while the car was operating and for approximately 10 minutes after shutdown. WIRED reports the continued activity and post-shutdown period.

This matters particularly for used-car owners. A previous owner may have canceled the account, removed the decal, or deleted the app while leaving the module and wiring under the dashboard. Purchase paperwork may not have transferred with the vehicle.

Deleting the app or switching off Bluetooth on the owner’s phone does not prove that the installed module is absent, unpowered, or unable to communicate. The supplied evidence does not establish an owner-operated setting that reliably disables the module’s Bluetooth radio. Until KARR or a technician confirms otherwise, phone-side Bluetooth controls should not be treated as the mitigation.

KARR and SWDS Hardware Require Identification, Not Guesswork

Researchers associated many installations with Southern California dealerships and vehicles sold from 2017 onward. Reporting named Honda, Toyota, Mazda, Ford, and Jeep dealerships in that regional history, with resale dispersing equipped vehicles elsewhere.

That does not mean every post-2017 vehicle, every Southern California vehicle, or every model from those manufacturers is affected. The relevant component is the aftermarket KARR or SWDS equipment, not the automaker’s factory alarm or keyless-entry system.

Start by checking the driver-side window for a KARR or SWDS marking. A sticker is a useful lead, but no sticker does not prove there is no device. Decals can be removed, omitted, or lost when glass is replaced.

With the car parked and switched off, visually inspect beneath the steering wheel and lower dashboard for an added button, module, indicator, or non-factory wiring. NBC 7 identifies an under-steering-wheel device as a possible clue and warns that disabled systems should still be updated. NBC 7 describes the window and under-dash identification clues.

Do not pull on a module, remove trim solely to find it, probe connectors, cut wires, or unplug an unidentified harness. Factory equipment and many unrelated aftermarket devices occupy the same area.

Review the purchase contract, addendum sticker, accessory invoices, service history, and any records received from a previous owner. Useful terms include KARR, SWDS, dealer alarm, theft protection, vehicle recovery, GPS, tracking, and immobilizer.

If the records are inconclusive, give the VIN to the selling dealer or KARR support and request written answers to these points:

• Whether KARR or SWDS hardware was installed
• The installed product or hardware configuration
• Whether it contains an affected Bluetooth component
• The firmware version it should be running
• Whether the system is active, inactive, or unassigned
• The supported update or removal procedure

A qualified automotive electronics technician can inspect an installation that the dealer or vendor cannot identify. The purpose is to document the module and wiring, not merely to find something that resembles an alarm.

The Firmware Update Is the Supported First Response

Acrisure released a firmware update on July 20, 2026. Reporting says it is not an automatic over-the-air update; the owner must complete the supported process. Active and inactive systems have update paths.

For an active customer, the reported path is to open the official KARR Security System app, sign in, connect to the alarm if prompted, open Customer Service, select Firmware Update, and follow the displayed instructions.

For an inactive or declined system, KARR reported a validation process using the final eight digits of the VIN. The owner installs or opens the official app, chooses the inactive-system route, enters those digits when requested, connects to the nearby alarm, and completes the firmware-update steps.

Current instructions in the official app or from KARR support should control if labels or sequencing have changed. Save the completion screen, firmware information, confirmation email, or support case number. The supplied evidence does not identify a separate owner-operated test that independently proves the flaw has been closed.

Escalate the case if the app cannot find the alarm, rejects the VIN, repeatedly disconnects, offers no firmware option, or never confirms completion. Record the error, phone type, app version, and any hardware details shown before contacting KARR, the dealer, or a qualified technician.

Professional Removal Addresses a Different Concern

Patching is the clearest supported response to the documented shared-key vulnerability. Removal addresses the broader question of whether you want third-party alarm, tracking, immobilization, and remote-control hardware in the car at all.

An owner who uses the security or recovery functions may reasonably update and retain the system. An owner who never requested it or does not want connected aftermarket hardware may consider professional removal.

The firmware update is not evidence that every separate privacy or reliability question has been resolved. The available reporting does not establish whether it changes broadcast identifiers, historical records in crowdsourced radio-location databases, GPS-data retention, app-account security, installation quality, or long-term support.

Researchers separately reported that persistent Bluetooth identifiers might appear in crowdsourced databases showing where radio devices had previously been observed. That could potentially reveal historical locations associated with a module. It is not continuous live GPS access and does not prove that an owner was stalked. Malwarebytes summarizes the identifier and historical-location concern.

Removal should be professional because some installations are integrated with ignition wiring and vehicle electronics. Before approving it, request the product model, wiring details, supported removal method, factory-wiring restoration plan, estimated cost, warranty implications, and confirmation that the car and its factory features operate normally afterward.

The Proportionate Response Depends on Patch Confirmation

A confirmed, documented update supports retaining the equipment if you want its features. An unpatched or uncertain KARR/SWDS installation calls for the official update process or written dealer/vendor verification. Inactive service still requires investigation because installed hardware may remain responsive.

A missing sticker, deleted app, canceled subscription, or disabled phone Bluetooth is not confirmation that the module is absent or mitigated. Equally, the KARR name alone is not proof that every installation is vulnerable or that a vehicle has been attacked.

The decisive evidence is the installed hardware and its documented firmware status. Identify the module without disturbing its wiring, complete the supported update, preserve confirmation, and use professional help when identification, updating, or removal remains uncertain.