Many dealers offer optional alarms as an add-on when you purchase a vehicle from them. A company called Karr sells such systems and is a leader in the field, with its technology installed in approximately 2 million vehicles across the U.S. However, not every owner may know that their vehicle has a Karr alarm to begin with, and that’s because some dealers actually install them and leave them there, whether the buyer wants to pay for their capabilities or not.
That’s a problem, because researchers at UC San Diego discovered a vulnerability in Karr’s system that could allow nefarious actors to send commands over Bluetooth to open car doors, disable the ignition, and enable all kinds of other chaos.
Fortunately, this is one of those cases where security experts have already notified Karr, and Karr has released an update to fix the oversight. wired. It can be installed through a companion smartphone app that anyone can download, whether they are a paying customer or not. If you fall into the latter camp, as I’m sure most of us do, you may wonder how to determine if your car even has the Karr tool. It turns out that such vehicles have stickers reading “Karr” or “SWDS” on the driver’s side windows, although if you’re in doubt, it’s not a bad idea to ask your dealer.
If you believe Carr, this vulnerability is nothing to worry about, and the company intends to work with dealers to notify owners of affected vehicles. A spokesperson for the firm said, “The vulnerabilities described in (UCSD’s) research are highly complex and present little risk to customers in real-world situations.” wired. “Nevertheless, we responded quickly and developed a firmware update to resolve the issue.” (In this case, “immediately,” is doing some heavy lifting, since it apparently took 18 months for the company to release this patch.)
The only problem with that calm tone is that researchers, clearly, don’t agree. A UCSD professor described it as “probably the worst” car hacking threat ever. These experts also demonstrated this wired That’s how easy it is to tamper with a Karr-equipped vehicle that hasn’t yet had the new update installed, as long as the hacker has the right software.
Curr-alert vehicles are not exposed to these hazards while in motion; The system’s Bluetooth radio remains on for up to 10 minutes after the car is turned off, widening the window for potential trouble.
The reason Carr’s hardware is present in far more cars than is actually used is because some of the more than 3,000 dealers nationwide the company works with have incorporated the technology as a loss prevention measure. Before the sale, when the cars are still on sale, dealers can track their inventory using Carr’s system. Then at the point of sale, dealers will offer customers the option to pay a regular fee to benefit from that protection. But if they refuse, the alarm will not necessarily be removed; Customers may have to request it, and even then, not every dealer will honor that request without making life difficult.
Part of this is another symptom of modern connected car ownership. But unlike the SignalTrace or Flock phenomenon, which we’ve been covering extensively lately (and, unfortunately, first-hand), there appears to be a common-sense solution to this problem: legally mandate that dealers must remove such alarms from their cars when they are sold, Until That customer has agreed and wants to pay for that monitoring going forward. The potential for bad actors to take advantage of external hardware that was never needed in the car in the first place is just too much to leave in place, and the dealers concerned need to understand that they are putting everyone at risk unless they take things like this seriously.
Got any tips? Contact us at tips@thedrive.com
