Submission + - One Shared Key Lets Phones Unlock or Immobilize 2 Million Cars (youtube.com)
cortex writes: A WIRED Investigations video (YouTube) shows UC San Diego researchers discovering that dealer-installed KARR (and SWDS) aftermarket car alarms—estimated in more than 2 million U.S. vehicles, mostly from Southern California dealerships since around 2017—share a single Bluetooth authentication key. Anyone within Bluetooth range can use a simple reverse-engineered app to silently unlock doors, disable the alarm, honk the horn, flash lights, or immobilize a parked car so it won’t start, often without the owner even knowing the hidden under-dash module is present or active (it can still respond even if the paid service was declined). The vendor (Acrisure Protection Group) has released a manual firmware patch via the KARR smartphone app; owners can check for a KARR/SWDS window sticker or a blinking light under the dash. Full details in the accompanying WIRED story.