Security Flaw Exposed in Dealership-Installed Systems

A significant security vulnerability has been identified in KARR and SWDS vehicle protection systems, raising concerns for millions of car owners. These devices, manufactured by Acrisure and commonly installed by dealerships as anti-theft and tracking solutions, suffer from a critical flaw that permits attackers to gain remote control via Bluetooth.


Researchers at the University of California San Diego (UCSD) discovered that approximately 2.2 million vehicles purchased from Southern California dealerships since 2017 are potentially at risk. While the initial distribution was concentrated in California, the secondary automotive market means affected vehicles could now be located anywhere in the United States or even overseas.


How the Vulnerability Works

The security systems in question are typically found in vehicles from manufacturers such as Honda, Toyota, Mazda, Ford, and Jeep. Affected cars are identifiable by a “KARR-SWDS” sticker on the driver-side window, with the hardware itself concealed under the dashboard.

The system is designed to allow owners to connect via a mobile app to manage basic functions, including:

  • Locking and unlocking vehicle doors
  • Activating the horn
  • Flashing the headlights
  • Disabling the ignition to prevent the engine from starting

The root of the problem lies in the system's architecture. The research team found that all these devices rely on the same universal secure key. Once this key is compromised, any vehicle equipped with the device becomes vulnerable to unauthorized access.


«Instead of smashing a window to get access to a vehicle, thieves could simply connect remotely via Bluetooth to the device inside the vehicle, and make it unlock car doors,» stated Jerry Yu, a co-author of the research.

Difficulties in Mitigation

The situation is compounded by the fact that the hardware remains active even if the owner does not pay for a subscription service. Furthermore, patching the flaw is not a straightforward process for the average consumer.

«Removing the devices is not trivial,» explained Yibo Wei, a PhD candidate at UCSD and co-author of the study. «You have to open up the dashboard and cut and reconnect the wires that are deeply intertwined with the car's computers and ignition system.»


Manufacturer Response

According to reports, the company behind the systems has stated that the issue is limited to units equipped with specific Bluetooth-enabled components. They have reportedly issued a firmware update to address the security concern. Additionally, researchers noted that they discovered a publicly accessible database that contained sensitive information regarding the vehicles equipped with these specific security modules.