This is disturbing:
…a team of security researchers at UC San Diego, who found that a model of aftermarket car alarm known as the KARR Security System, installed in more than 2 million vehicles across the US by their estimate, can let any hacker within Bluetooth range send radio commands to silently unlock the car at will, turn off its alarm, honk the car’s horn or flash its lights, or even disable its ignition and leave a driver stranded.
Always helpful when Andy and the team create a video describing the issue and the fix.
https://www.wired.com/video/watch/i-stole-a-car-by-hacking-this-hidden-device
Some key timestamps:
00:48 An overview of the issue by a UCSD researcher
19:10 How to patch
Note: an obvious sign you may have this device is a driver’s side window sticker “KARR”
So this will be presented at DEFCON and Usenix? Very cool.
NapTime ForTruth • August 5, 2026 9:03 AM
@ Jason Sullivan:
Good suggestion! I hear it’s available as a KITT.
Tony • August 5, 2026 12:20 PM
Presumably a good Samaritan could install the app on their phone and wander through parking lots doing the firmware update for people. But probably illegal to “hack” somebody else’s device, even though doing it to help them.
Hacketry • August 7, 2026 8:27 AM
Regarding: https://www.schneier.com/blog/archives/2026/08/vulnerabilities-in-car-anti-theft-device.html
A friend of mine who works in a car dealership (VW) wrote:
“am familiar with the KARR system. It was designed as a way for dealerships to keep track of their cars, and was hardwired in a clearly mistaken belief that hardwiring would make them less vulnerable—my dealerships use a tracker that is simply placed in the car and can be tossed out a window if found. I should also add that the trackers my dealerships use do nothing except track location. The KARR trackers are designed immobilize a car, if necessary, once theft is reported.Another problem with the KARR system is that a quick look under the dash will show the blinking light. There is nothing subtle about it (let’s not forget the KARR window stickers). A car thief can still disable the system: it’s more a question of how much time he or she spends on any given car.
I view the problem with all these trackers as being reactive rather than proactive: oh look, my car’s been stolen, let me hit the immobilizer. Some car manufacturers are making it harder to start the car without a proper key — the ignition on my car requires a code from the key fob — it can’t simply be hard wired.
When people ask me, I point out that most cars that have trackers have the equivalent of an AirTag. And although an AirTag won’t track a car in real time, it’s better than nothing. Until the FindMy app alerts the car thief that there’s a tracker nearby.”
Clive Robinson • August 7, 2026 8:50 AM
@ Hacketry, Bruce,
I’ve already tried posting the information you have…
But it appears to have been deliberately withheld for some reason.
It should be within the system thus retrievable for posting. I guess we will have to wait and see.
When you read through the info on KARR, you will see five user selectable options the last of which is the
“5, Mayhem Command”
This has been quite deliberately “engineered in” to protect “Repo-Men” from those who are legaly contracted in an ownership position.
The idea being to create noise, confusion and attract lots of attention that the Repo-Man can hide behind and either “complete or retreat” safely.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Jason Sullivan • August 5, 2026 8:54 AM
Clearly consumers should have gone with the Knight Industries 2000 car alarm models.