If you are into cars and are old enough to remember manually rolling the windows down, this will be one of those moments where you will (rightfully) feel modern cars have turned into computers on wheels. 

More than 2 million vehicles in the US could be vulnerable to Bluetooth-based hacking because of a security flaw affecting anti-theft devices installed in several popular models, including those from Ford, Jeep, Toyota, Honda and Mazda.

According to reports by Wired and Popular Science, the issue is linked to the KARR Security system, an aftermarket anti-theft device that many dealerships install before selling vehicles.

Cybersecurity researchers found that hackers within range could exploit the device to unlock doors, disable alarms, honk the horn, flash the lights, and prevent a vehicle from starting.

Based on the Popular Science report, researchers from the University of California, San Diego (UCSD) discovered that every affected KARR device used the same authentication key. After reverse-engineering the system's mobile app, they were able to communicate with any vulnerable device over Bluetooth.

During demonstrations, the researchers unlocked vehicles, activated the horn and lights, and disabled the ignition after the engine had been turned off. They noted that the flaw cannot be used to remotely drive a vehicle away.

However, if someone gains physical access to the car, they could potentially use other tools to create a new key, which could help them drive away.

The concern does not end here either. The Wired report states that many owners may not even know their vehicle comes with the KARR system installed by dealerships. Even if buyers chose not to purchase the optional security package, the hardware stayed installed in the vehicle.  

What is being done to prevent the risk of your car being hacked?

Following the discovery, KARR Security's parent company, Acrisure Protection Group, released a firmware update to address the vulnerability, encouraging owners to install the update via the KARR Security app on their phones. 

Based on the Wired report, the company said in a statement that it rolled out a patch promptly, but it actually took them 18 months to do so. 

UCSD also reportedly notified the company of the risk sometime in January last year, but the patch was rolled out only weeks before the 2026 DEF CON hacker conference in August, where the researchers were going to demonstrate the vulnerabilities. 

Owners can check whether their vehicle has the system by looking for a KARR or SWDS sticker or a small blinking button mounted beneath the dashboard. If the device is present, researchers recommend updating it through the KARR Security app to reduce the risk of unauthorized access.

Personal note: We need a tech detox in modern cars; just enough to keep commuting easy. It’s high time. 

Read more at Motor Culture!

Written by

Aaradhya Singh

Edited by

Suyashdeep Sason