Researchers at UC San Diego found a glitch in an anti-car theft system that could make millions of vehicles in Southern California susceptible to theft.
The device from Carlsbad-based KARR Security Systems is installed in vehicles sold at most dealerships in Southern California. It affects cars even if buyers declined to have the system activated.
“About half of the people that have it installed don’t actually know that they have it in their car,” said Aaron Schulman, a computer science professor at UCSD and the lead author on the study.
He and his team found the vulnerability in 2018. They were studying card-skimming technology thieves were using and found something was off.
“They were using Bluetooth actually to pull the credit card numbers from these skimmers,” Schulman said. “So we were actually searching all around for them. And we found both these skimmers and this weird device that was becoming super prominent starting in 2017.”
It took a few years for researchers to find the source.
“We realized that this is actually an alarm system or security system that is actually deployed in vehicles,” said Nishant Bhaskar, a co-author on the study.
He said it was not just a few cars, but more than 2.2 million cars sold in Southern California since 2017. The Bluetooth signal enabled the device to connect to the company’s app, allowing users to locate their vehicles and shut off the engine if the vehicle were stolen.
“We reverse engineer the application that is used by the company to access these cars,” Schulman said.
With that, the researchers were able to lock and unlock the car and honk the horn even while someone was driving. They were able to do that because KARR Security uses a universal Bluetooth key to access its system. It would be like using “1234” as your passcode.
“That essentially made it so that we could create a version of that app ourselves and use that to unlock every single vehicle that has the security system,” Bhaskar said.
“This is one of the biggest vulnerabilities of a Bluetooth device that has ever happened in terms of scale,” Schulman said.
As a result, Schulman and his team contacted KARR Security. Representatives from the company came down to UCSD to work with the team and studied the issue.
In a statement, the company said it maintains rigorous standards to protect customers’ vehicles.
“The vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions,” the statement said. “Nevertheless, we responded promptly and developed a firmware update to address the issue.”
The company released a firmware patch on July 20. To install the patch, users need to download the KARR Security app and follow the directions.
To see if your vehicle is affected, check for the sticker with the words “KARR” or “SWDS” on your window.
