BLE Theft Auto - Anti Theft System Exposes Over 1M Cars

The researchers from UC San Diego began with an unrelated study of Bluetooth credit card skimmers at gas pumps. Their scans kept picking up an unfamiliar device, and an FCC filing identified it as KARR, an aftermarket anti-theft system that dealers install and offer as a paid upgrade. The team then studied six aftermarket Bluetooth systems in total and reported that three had serious flaws.

The Android app turned out to be a .NET application packed into a compressed assemblies blob, which hid its Bluetooth code from standard APK analysis. The authentication was a challenge-response scheme, but one ingredient, the secret key, was hard-coded and shared by every unit. Access control existed only in the app's interface, because the server simply listed which vehicles a user could see. Even in the disabled no-sale mode, the device still accepted a mode-change command, which let an attacker restore full control. The demo showed door unlocking, immobilizer disabling, and horn and light triggering.

The vendor later removed the universal key from the app and issued per-vehicle keys, and disabling the unit in no-sale mode now appears to turn it off fully. The team also described a remote starter system whose pairing QR code was built from a public MAC address, and a dealer-linked product they could not fully assess. Their takeaways: aftermarket devices sit outside OEM security reviews, Bluetooth's built-in pairing does not cover vehicle control, and owners with KARR should check for a window sticker and apply the update.