I spend a lot of my time on a narrow problem: taking the data a car will actually tell you about itself — OBD-II trouble codes, live sensor PIDs, freeze-frame snapshots — and turning it into a plain-English answer about what's wrong. That's CarSense. The whole premise is that your car knows more than it's telling you, and the gap between those two things is where people get taken advantage of.
This week researchers at UC San Diego published something that sits in exactly that gap — and that my own tools are completely blind to.
The device
There's an aftermarket alarm called KARR that dealerships install on cars while they're still sitting on the lot. It's mounted behind the dashboard, spliced directly into the ignition wire, and wired into the door locks, lights, and trunk. Dealers started doing this to stop theft from their own lots, which is a reasonable thing to want.
The UCSD team found that every KARR unit ever deployed shares the same Bluetooth authentication key. Not one key per car. One key, period. They recovered it by reverse-engineering the vendor's own phone app, then reimplemented the protocol themselves.
Anyone within Bluetooth range with that key can talk to your car.
Roughly 2.2 million American vehicles have one installed. By the researchers' estimate, about half of those owners don't know it's in there.
"I told them I didn't want it"
Here's the part that got my attention.
The alarm goes in before you ever see the car. It gets offered to you during price negotiation as an upgrade — pay extra, get a phone app that locks and unlocks your car. Plenty of people decline.
When you decline, the dealer deactivates it. They don't remove it. Pulling it back out would mean undoing the ignition splice and the harness work, and nobody's doing that on a car they're trying to sell you this afternoon.
The researchers found that a deactivated unit still wakes its Bluetooth radio every time the car starts — and can be switched back into an active state by someone nearby. The only outward sign is a brief honk.
So there's a meaningful population of people who explicitly said no to this product, believe they don't have it, aren't in the vendor's customer database, and are carrying it around anyway.
What it can and can't do
Worth being precise, because some of the coverage has smeared this into something it isn't.
Demonstrated by the researchers: lock and unlock the doors, silence the alarm, sound the horn, flash the lights, and prevent a parked car from starting — the dash reads "key not found," and there's no obvious diagnostic path to figuring out why. Practically speaking, that's a tow.
Not possible: remotely starting the car, or touching anything on a car that's moving. No steering, no brakes, no throttle.
So this isn't the 2015 Jeep Cherokee demo, where researchers killed a transmission on a highway from miles away and Fiat Chrysler recalled 1.4 million vehicles. The realistic risk here is duller and more common: theft and harassment. A silent unlock removes the broken window that normally makes stealing a car loud. And a car that won't start is a stranded person.
There's a quieter privacy problem too. The device broadcasts a serial number that never changes, and hobbyist wardriving databases publicly log Bluetooth signals alongside the location where they were observed. That combination means a fixed identifier tied to a place — where a specific car regularly sleeps.
The 30-second check
No app, no scanner, no mechanic:
- Look for a sticker on the driver's-side window reading KARR or SWDS (SouthWest Dealer Services).
- Look under the dashboard for a small button with a blinking LED, usually low and near the steering column.
Either one means you probably have it. Don't go hunting for the module itself — it's buried behind the dash, and the sticker and the light are the reliable tells.
The install base is concentrated at Honda, Toyota, Mazda, Ford, and Jeep dealerships, originally in Southern California — but those cars get resold, and the researchers report seeing the signature nationwide. This is a dealer practice, not a manufacturer one, so there's no make or model that's inherently clear. Check the sticker.
The fix, and why it's structurally broken
Acrisure Protection Group, which sells KARR, shipped a firmware patch on July 20, 2026. To install it: download the KARR Security app, connect to your alarm, then Customer Service → firmware update. Their site is karrsecurity.com.
Now the engineering problem. The device has no cellular modem and no internet connection — it is Bluetooth-only. There is no over-the-air update path. There is no fleet. Every one of those 2.2 million units has to be patched individually, by a human being standing next to that specific car, holding a phone, who has been convinced this is worth doing.
And the population most at risk is the population hardest to reach, by construction: they declined the product, so they aren't customers, so there's no channel to notify them. A recall letter never comes, because on paper they never bought anything.
The researchers disclosed this in January 2025. The patch arrived about eighteen months later. Acrisure has publicly characterized the vulnerability as highly complex and low-risk in real-world conditions. The researchers demonstrated stealing a car with it in roughly two and a half minutes.
Why my own tools are useless here
This is the part I keep turning over.
I build diagnostic software. Plug an adapter into the OBD-II port, and the car will tell you about misfires, oxygen sensors, fuel trim, evap leaks — hundreds of parameters. It is a genuinely good window into a car's health.
It cannot see this. The KARR module isn't an emissions-relevant component, so it doesn't report to the standardized diagnostic layer. It throws no trouble code. It appears in no service history. It isn't in the VIN build sheet, because the manufacturer didn't install it — a dealer did, after the car left the factory. Every tool I'd normally reach for, including my own, returns nothing.
The only reliable detector is a sticker on a window.
That's the actual lesson, and it generalizes past this one alarm. The diagnostic surface of a modern car covers what the manufacturer put in it. Everything bolted on afterward — by dealers, by insurers offering telematics dongles, by fleet vendors, by whoever installed that remote start — lives outside it. There's an entire category of hardware in your car with real access to locks and ignition, and no inventory of it exists anywhere you can query.
I don't have a product answer for that. I'm not sure there is one; a scanner app would be chasing an install base that shrinks with every patched car, and the free check is already easier than downloading anything. But it's changed how I think about what "reading a car's data" actually covers.
For now the useful thing is small and boring: go look at your driver's-side window. It takes half a minute, and about a million people who'd swear they don't have one of these are wrong.
Further reading: UC San Diego's announcement · WIRED's Hack Lab segment, where Andy Greenberg runs the theft demo · The Drive · Malwarebytes