Millions of vehicles in Southern California may be vulnerable to hackers because of a security flaw involving KARR or SWDS anti-theft devices, according to UC San Diego researchers who discovered the issue. Researchers said there have been no reports of hackers exploiting the vulnerability, but d rivers who have a KARR or SWDS anti-theft device should install an available security update — even if the device is disabled. The vulnerability could potentially allow someone to remotely unlock a vehicle, honk its horn, flash its lights or even turn off the car without touching it, regardless of whether the vehicle is parked or moving. Nishan Bhaskar, a former UC San Diego Ph.D. student, demonstrated what someone could potentially do from a few yards away. Former UCSD student Nishan Bhaskar hacks a car’s anti-theft system with a “universal key” that can access millions of cars in Southern California. “This vehicle currently is locked, but then I can just press this button here, and it’s fully unlocked,” Bhaskar said. “I can turn on the horn, and the lights also can be used so they can flicker when I unlock and lock,” Bhaskar said. Bhaskar laid the groundwork for the research in 2018, which eventually led later students to discover a system vulnerability affecting vehicles protected by KARR or SWDS anti-theft devices. “The entire system utilizes this sort of security key, and that security key is used universally on all the alarms that are out there,” Bhaskar said. UCSD Professor Aaron Schulman explains how the multi-year research yielded the discovery of the anti-theft system’s vulnerability. More than 2 million vehicles in Southern California were found to be at risk in 2024, according to UC San Diego professor Aaron Schulman, who oversaw the research. “We estimate over half of them actually don’t even know that this system is active in their car,” he said. Schulman added that he contacted KARR after his students told him about the universal key they found that could access millions of devices. “Within a few days, they brought their security team and implementation team on campus here. We demoed the vulnerability to them. And then we had about an hour-long meeting just talking about what should happen next to get this patch,” Schulman said. How to check your car and install the security update Car owners should look for the KARR sticker or the anti-theft device installed under the steering wheel. Drivers should first determine whether their vehicle has one of the affected anti-theft devices. Look for a decal on the driver’s side window, but keep in mind that the decal may have been removed if the vehicle was purchased used. Drivers can also look for the device itself under the steering wheel. Do not forcefully remove the device. It is intertwined with the vehicle’s computers and ignition systems. To install the patch, download the KARR app, which provides options for either an activated or disabled device. Get inside the vehicle and follow the prompts in the app to complete the update. Schulman said researchers discovered the problem almost two years ago before discussing their findings publicly, giving the company time to develop a fix. “If this was a catch-up game, we would be in a lot of trouble,” Schulman said, referring to hackers finding the vulnerability before they did. Schulman described how computer security researchers approach potential vulnerabilities. “That’s one thing we are very good at as a computer researcher, is that we focus on kind of like, if I were evil, what would I do?” Schulman said. Now that a security update is available, Schulman said vehicle owners need to take action. “And it is urgent for you to do it right now,” Schulman said. KARR said the issue is not limited to KARR security systems because other companies use the same anti-theft device technology across the country. KARR also provides online instructions and tutorials for installing the update. This story was originally reported for broadcast by NBC San Diego. AI tools helped convert the story to a digital article, and an NBC San Diego journalist edited the article for publication. ...read more read less