KARR Bluetooth flaw exposes 2.2M cars to theft risk

Could a tiny instrumentality hidden beneath your dashboard marque your car easier to interruption into? Nancy from Newtown, Pennsylvania, asked maine wherever she should look for the KARR oregon SWDS "code" successful her 2025 Cadillac XT5 and 2024 Hyundai Tucson Limited Hybrid.

Here is the archetypal happening you request to know. There is nary codification to find successful your vehicle's settings. KARR and SWDS notation to aftermarket information hardware that a dealership whitethorn person installed earlier selling the car. SWDS stands for Southwest Dealer Services, the institution associated with respective KARR-branded conveyance extortion products.

The instrumentality usually sits beneath the dashboard connected the driver's side. You whitethorn besides find a KARR oregon SWDS sticker connected the driver-side window.

So, earlier you commencement searching done menus oregon calling the automaker, present is however to find retired whether your conveyance has 1 of these devices and what to bash next.

15 SECURITY ESSENTIALS TO KEEP YOUR VALUABLES SAFE FOR SUMMER TRAVEL

A Bluetooth flaw successful dealer-installed KARR and SWDS information devices could exposure astir 2.2 cardinal vehicles to unauthorized access. (David Baillot/University of California San Diego/Jacobs School of Engineering)

CyberGuy Live: Missed "Sick of Spam?" Get the replay and checklist

Our escaped CyberGuy Live people "Sick of Spam?" has ended, but you tin inactive ticker the afloat replay and download our spam-stopping checklist. Kurt "CyberGuy" Knutsson walks you measurement by measurement done elemental ways to trim robocalls, spam texts, junk email and unwanted messages. You’ll besides larn however to curb governmental texts, cleanable up your inbox and spot messages that could enactment your idiosyncratic accusation astatine risk.

Get the free replay and checklist now astatine CyberGuyLive.com.

KARR Bluetooth car hack puts 2.2 cardinal vehicles astatine risk

Computer information researchers astatine the University of California San Diego uncovered a Bluetooth vulnerability affecting astatine slightest 2.2 cardinal vehicles. The flaw involves dealer-installed KARR and SWDS information devices. A idiosyncratic lasting wrong astir 5 yards of a susceptible conveyance could link to the instrumentality done Bluetooth.

From there, an attacker could fastener oregon unlock the doors. The aforesaid flaw could soundlessness the alarm, dependable the horn oregon flash the headlights. An attacker could besides forestall a parked conveyance from starting. However, the researchers did not study that the flaw could commencement the motor oregon unopen down a conveyance that was already running. That favoritism is important. The Bluetooth flaw unsocial does not fto idiosyncratic thrust away. However, it could softly unlock the doors. A thief could past usage abstracted tools to make oregon programme a key.

What are KARR and SWDS car information systems?

KARR systems are aftermarket conveyance information products sold done participating dealerships. They whitethorn see an alarm, GPS tracking, distant conveyance controls oregon an ignition-disabling feature. Southwest Dealer Services uses respective merchandise names, including KARR Security, KARR Fusion, KARR BT, KARR S.W.A.T. and S.W.A.T. Dealer. The features alteration by merchandise and vehicle.

These devices bash not travel from Cadillac, Hyundai, Ford oregon different automaker's factory. A dealership oregon 1 of its vendors adds the hardware aft the conveyance arrives. Dealers whitethorn usage the strategy to support inventory sitting connected the lot. When idiosyncratic buys the vehicle, the trader whitethorn connection the strategy arsenic an further information package. The occupation is that immoderate dealers near the hardware connected adjacent erstwhile buyers declined the service. As a result, a operator mightiness person a susceptible instrumentality without an progressive KARR relationship oregon immoderate thought that the instrumentality is wrong the car.

How the KARR Bluetooth vulnerability works

The KARR instrumentality communicates with a smartphone app done Bluetooth Low Energy. Researchers recovered that the affected devices relied connected the aforesaid concealed authentication key. Once they recovered that key, they could nonstop commands that susceptible KARR devices accepted.

Think of it arsenic giving a immense radical of devices the aforesaid unchangeable password. Once that password becomes known, each instrumentality becomes easier to approach. The researchers besides recovered that the devices broadcast recognizable Bluetooth signals. Historical databases containing those signals could uncover wherever a peculiar instrumentality had appeared. That creates a privateness interest beyond car theft. Someone could perchance usage the information to survey wherever a conveyance regularly parks oregon travels.

Which cars whitethorn person a KARR oregon SWDS device?

UC San Diego researchers recovered the devices astir often successful vehicles sold done Honda, Toyota, Mazda, Ford and Jeep dealerships successful Southern California since 2017. However, that database does not mean different brands are safe.

KARR works with much than 3,000 dealerships nationwide. Vehicles besides determination astir the state done used-car sales, auctions and dealership trades. Therefore, the vehicle's marque and exemplary cannot corroborate whether it has the equipment. The dealership that prepared the conveyance for merchantability matters much than the badge connected the grille. A Cadillac, Hyundai oregon Chevrolet could person a KARR strategy if the selling trader installed one. A Honda from different dealership mightiness ne'er person received it.

How to cheque your car for a hidden KARR device

Start with the casual clues earlier you region immoderate trim oregon crawl excessively acold beneath the dashboard.

Check the driver-side model for a KARR sticker

Look astatine the little corners and edges of the driver-side window.

The sticker whitethorn say:

• KARR
• KARR Security Systems
• SWDS
• S.W.A.T.

A sticker powerfully suggests that the dealership installed a related device. However, the lack of a sticker cannot wholly wide your vehicle. A trader oregon erstwhile proprietor whitethorn person removed the statement portion leaving the hardware connected. UC San Diego says galore affected vehicles person the sticker, alternatively than each affected vehicle.

Look beneath the driver-side dashboard

Park the conveyance and unopen disconnected the engine. Move the driver's spot backmost and usage a flashlight to look beneath the little dashboard. Researchers accidental the instrumentality is usually installed underneath the dashboard connected the driver's side.

You whitethorn spot a tiny fastener oregon indicator airy attached to the bottommost borderline of the dash. Wiring whitethorn tally from the fastener down the dashboard panels. The fastener shown by UC San Diego is tiny and casual to miss. It tin look similar a basal aftermarket alarm power alternatively than a modern connected device. Do not propulsion connected the wires oregon disconnect anything. The module whitethorn link to the ignition strategy and different conveyance electronics.

Review your conveyance income paperwork

Check the acquisition agreement, trader addendum, concern documents and work records.

Search for references to:

• KARR Security
• KARR BT
• KARR Fusion
• KARR S.W.A.T.
• SWDS
• Southwest Dealer Services
• Dealer alarm
• Vehicle betterment system
• Inventory information system

The complaint whitethorn look arsenic portion of a larger trader extortion package. You whitethorn besides find the merchandise listed with nary abstracted terms if the trader installed it for inventory control.

TESLA HELPED SAVE A DRIVER; IS YOUR CAR READY?

Some Jeep, Ram and Chrysler drivers antecedently saw promotional messages connected infotainment screens done Stellantis’ Uconnect system. (Kurt "Cyberguy" Knutsson)

Ask the selling trader to cheque your VIN

Call the dealership that primitively sold the vehicle. This measurement tin assistance adjacent erstwhile you bought the car utilized from different business. Your VIN appears adjacent the bottommost of the windshield connected the driver's side. You tin besides find it connected the registration, security paper and driver-side doorway frame.

Ask the dealer: "Can you cheque this VIN and corroborate whether your dealership oregon inventory vendor installed a KARR, SWDS, KARR BT, S.W.A.T. oregon different aftermarket information module?"

Then inquire these follow-up questions: "Is the instrumentality inactive connected?" "Has it received the firmware update released connected July 20, 2026?" "Can you supply the instrumentality exemplary and firmware presumption successful writing?"

A vague reply specified arsenic "Your mill alarm is fine" does not code the question. You are asking astir dealer-installed aftermarket equipment.

Use the KARR app to cheque your VIN

KARR says radical who ne'er activated the information work tin inactive usage the authoritative KARR Security app to cheque their VIN. Download the app lone done the authoritative Apple App Store, Google Play Store oregon KARR website. Do not usage an app nexus from an unexpected substance message, email oregon online advertisement.

After opening the app adjacent the vehicle, pat the lawsuit work nexus astatine the bottommost of the screen. The app should usher you done the VIN cheque and disposable firmware update. KARR besides lists lawsuit enactment astatine 800-395-5277.

What Nancy should cheque connected her Cadillac and Hyundai

Nancy's 2025 Cadillac XT5 and 2024 Hyundai Tucson Limited Hybrid were not among the circumstantial brands UC San Diego researchers said appeared astir often. However, that does not regularisation them out. The instrumentality comes from the dealership alternatively than Cadillac oregon Hyundai.

Nancy should cheque each SUV separately. First, she should look for a KARR oregon SWDS sticker connected the driver-side window. Next, she should usage a flashlight to inspect the little borderline of the dashboard adjacent the driver's knees.

She should besides reappraisal the paperwork from each dealership. If the vehicles came from antithetic dealers, 1 could person the instrumentality portion the different does not. Finally, Nancy should telephone some selling dealers with the VINs. She should inquire whether either dealership installed a KARR, SWDS oregon S.W.A.T. module earlier delivery. If the dealers cannot supply a definite answer, she tin usage the authoritative KARR app oregon telephone KARR support.

How to update a KARR information system

Acrisure released a firmware spot connected July 20, 2026, 1 time earlier UC San Diego publically announced the vulnerability. The conveyance proprietor indispensable present the update to the KARR instrumentality done the authoritative KARR Security app. Updating your telephone oregon conveyance infotainment strategy volition not spot the abstracted module.

Update an activated KARR system

An activated strategy means you purchased oregon activated KARR work done the dealership.

Follow these steps:

• Go to the vehicle and beryllium successful the driver's seat.
• Open the KARR Security app.
• Log successful and prime the correct vehicle.
• Tap the Settings fastener successful the lower-right corner.
• Scroll down and pat Check for Updates.
• Follow the instructions shown successful the app.
• Wait for confirmation that the firmware is current.

KARR says nary further enactment is indispensable aft the app confirms that the latest firmware is installed.

Update a KARR strategy you ne'er activated

You tin inactive cheque and update a instrumentality that remained successful the conveyance aft you declined the service.

Follow these steps:

• Download the authoritative KARR Security app.
• Sit successful the driver's spot near the device.
• Open the app.
• Tap the Customer Service: 800-395-5277 link.
• Follow the app's instructions to cheque the VIN.
• Complete the firmware update erstwhile prompted.
• Confirm that the app reports the latest firmware.

Call KARR enactment erstwhile the app cannot find the conveyance oregon implicit the update.

WAYMO RECALLS ROBOTAXIS OVER CONSTRUCTION-ZONE RISK

Drivers tin cheque for a KARR oregon SWDS instrumentality by inspecting the driver-side window, dashboard country and conveyance income paperwork. (David Baillot/University of California San Diego/Jacobs School of Engineering)

Should you region the KARR device?

You tin inquire to person the strategy deactivated oregon removed. However, I would not crook this into a play do-it-yourself project. Researchers pass that removal whitethorn necessitate opening the dashboard, cutting wires and restoring connections involving the ignition strategy oregon conveyance computers. Disconnecting the incorrect ligament could halt the car from starting. It mightiness besides impact the mill alarm, distant commencement oregon different electrical feature. Southwest Dealer Services says an proprietor tin petition removal, transportation oregon deactivation by calling 800-395-5277 and confirming the relationship information.

Ask the archetypal dealership oregon a qualified automotive electrical technician to grip the work. Before approving removal, inquire the technician however the mill wiring volition beryllium restored. Afterward, petition written confirmation that the module was removed and the vehicle's archetypal information functions inactive work.

We reached retired to KARR Security, and a typical from the institution provided CyberGuy with the pursuing statement:

"KARR Security maintains rigorous standards to assistance support customers’ vehicles. Researchers astatine UC San Diego identified a vulnerability affecting BLE-based car theft devices, including a tiny percent of KARR devices with definite Bluetooth-related components. The vulnerability described successful the probe is highly analyzable and presents a debased hazard to customers nether real-world conditions. Nevertheless, we responded promptly and developed a firmware update to code the issue. We launched this app/firmware update connected July 20, 2026. Active customers whitethorn use the update straight from their telephone aft securely logging successful to the KARR Security app. Vehicle owners of non-active systems tin inactive update via the app utilizing their VIN (last 8 digits) arsenic a validation step. Consumers tin find elaborate instructions and tutorials for assistance with this firmware connected the Customer FAQ conception of our website astatine www.KARRSecurity.com."

KARR Security added, "To our knowledge, we person not seen this vulnerability utilized successful the existent satellite to interruption into oregon bargain a vehicle."

What volition not hole the KARR Bluetooth flaw

Turning disconnected Bluetooth connected your telephone volition not disable the Bluetooth vigor wrong the KARR module. Deleting the app volition not region the device. Removing the conveyance from your phone's mean Bluetooth paper volition not spot it either.

The KARR module communicates separately from the Cadillac, Hyundai oregon different mill infotainment system. A Faraday pouch besides volition not hole this peculiar problem. Faraday pouches tin assistance artifact relay attacks involving a cardinal fob. They cannot update oregon disable hardware installed beneath the dashboard. You request to update the KARR instrumentality itself oregon person a nonrecreational region it.

Tips to support your conveyance from being stolen

Car thieves usage antithetic methods, truthful protecting your conveyance requires much than 1 portion of technology.

1) Install the KARR firmware update first

When your conveyance has a KARR oregon SWDS device, instal the firmware update arsenic soon arsenic possible. This straight addresses the Bluetooth flaw identified by the researchers. A steering instrumentality fastener oregon tracker tin adhd protection, but neither 1 repairs susceptible software.

2) Confirm your doors really locked

Signal jammers tin sometimes artifact the bid sent by a cardinal fob. After pressing the fastener button, perceive for the mean confirmation sound. Look for the lights and propulsion a doorway grip earlier walking away. Also, adjacent each model and instrumentality the keys with you. NHTSA recommends checking the doors whenever you permission a parked vehicle.

3) Add a disposable steering instrumentality lock

A steering instrumentality fastener creates an evident obstruction wrong the car. It volition not halt each determined thief. However, it adds clip and makes the conveyance harder to steer. NHTSA includes steering instrumentality locks among disposable devices that tin discourage conveyance theft. You tin find much ideas successful my CyberGuy usher connected however to assistance forestall your car from getting stolen.

4) Protect your cardinal fob astatine home

Store cardinal fobs distant from exterior doors, windows and attached garages. A tested signal-blocking pouch tin assistance trim the hazard of a relay attack. In that benignant of theft, criminals widen the awesome from a cardinal wrong the location to a conveyance outside. Test the pouch regularly. Put the cardinal inside, adjacent the pouch and basal adjacent to the car. The doors should stay locked erstwhile you interaction the handle. Remember that a key-fob pouch protects against a antithetic attack. It volition not spot a KARR module.

5) Add a conveyance betterment tracker

A hidden GPS tracker oregon Bluetooth tracker whitethorn assistance find a stolen vehicle. However, bash not face anyone oregon effort to retrieve the car yourself. Give tracking accusation to instrumentality enforcement. An Apple AirTag tin supply a backup determination signal, though Apple's anti-stalking alerts whitethorn yet pass a thief that an chartless AirTag is traveling with the vehicle. Read my CyberGuy usher connected utilizing an AirTag successful a conveyance and knowing its limits.

6) Choose a safer parking spot

Use a locked store erstwhile 1 is available. Otherwise, parkland successful a disposable country with lighting, ft postulation oregon a information camera. Avoid isolated corners wherever idiosyncratic tin enactment astir the conveyance without attracting attention. NHTSA besides recommends parking successful well-lit areas whenever possible.

7) Remove valuables from sight

A thief whitethorn interruption into a car without readying to bargain the full vehicle. Take phones, laptops, wallets and bags with you. Do not permission a spare cardinal oregon store distant wrong the car. NHTSA warns that thieves commonly people electronics and different items they tin rapidly resell.

Kurt's cardinal takeaways

Nancy's question highlights the biggest occupation with this vulnerability. Many drivers person nary thought that a KARR oregon SWDS instrumentality whitethorn beryllium hiding successful their vehicle. You volition not find a KARR codification wrong your vehicle's settings. Look for a sticker connected the driver-side model and a tiny aftermarket fastener beneath the dashboard. Then cheque your paperwork and inquire the selling trader to hunt your VIN. The flaw tin unlock a susceptible conveyance and interfere with its information features from nearby. It cannot commencement the motor by itself oregon unopen down a moving car. Still, unlocking the doors whitethorn springiness a thief the entree needed to effort different method. Fortunately, KARR has released a firmware update. Install it done the authoritative KARR Security app. When you nary longer privation the system, put nonrecreational removal alternatively than pulling wires yourself.

Should dealerships person to archer you astir each connected instrumentality installed successful your car, adjacent erstwhile you diminution to acquisition the service? Let america cognize by penning to america astatine CyberGuy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report

• Get my champion tech tips, urgent information alerts and exclusive deals delivered consecutive to your inbox.
• For simple, real-world ways to spot scams aboriginal and enactment protected, sojourn CyberGuy.com – trusted by millions who ticker CyberGuy connected TV daily.
• Plus, you'll get instant entree to my Ultimate Scam Survival Guide escaped erstwhile you join.

Copyright 2026 CyberGuy.com. All rights reserved.