Millions of cars carry a hidden alarm — and it protects every one with the same key

Cybersecurity 5 min 80 sources

Researchers found 2.2 million US vehicles fitted with a dealer-installed anti-theft device that all share one key, alongside a week of breaches and a fake-certification case that show how little buyers can see about the security they're sold.

Key takeaways

Researchers found 2.2 million US cars carry a dealer-installed KARR alarm that all share one key — check for a KARR/SWDS sticker and apply the firmware fix if you have it.
A car alarm, a faked safety label, and a data breach share one problem: you can't see the security you're being sold until it fails.
Reused passwords remain the easy way in — Chick-fil-A accounts were hit with stolen logins from other breaches; a unique password per account and a second login check break the chain.

The most unsettling security story this week is one most drivers have no idea applies to them. Researchers at the University of California San Diego say at least 2.2 million vehicles in the US carry a dealer-installed anti-theft device that all rely on the same key — meaning anyone who knows that key, and gets within a few yards with a Bluetooth connection, can unlock the car, honk its horn, flash its lights, or stop it from starting [50][59].

The alarm nobody asked for

The device is the KARR Security System, an aftermarket alarm sold by Acrisure Protection Group and its subsidiary SWDS, or SouthWest Dealer Services [50]. Car dealers install it on the lot to stop theft. Here is the part that stings: when the car is sold, the alarm usually stays wired in — even if the buyer declined to pay for it. UCSD estimates at least half of the owners who have the device never asked for it and don’t know it’s there [59].

“It’s designed to make cars more secure,” said Aaron Schulman, the UCSD professor who led the work, “but ultimately it’s created a vulnerability” [59]. His team found the flaw is not one weak unit but the whole design: the devices “all rely on the same secure key” [50]. Break one, and you understand them all. The researchers described the effect plainly — rather than smashing a window, someone could connect over Bluetooth and make the car unlock its doors [50].

To be clear about what’s confirmed: this is published research from a university team, not a wave of attacks in the wild. The full write-up isn’t out until August 12 [50]. Acrisure rolled out a firmware fix — a software update for the device — on Monday for the vulnerable Bluetooth model [59].

What to do if you drive in the US, especially Southern California, where the device is most common: look for a “KARR” or “SWDS” sticker on the driver’s-side window, and a small button with a blinking light under the dashboard [59]. If you have it, install the KARR Security app, connect it to the alarm, and apply the firmware update [59]. It is an odd position to be in — patching a component you never bought — but it is the fix on offer.

You can’t inspect what you’re sold

The car story rhymes with a quieter one from a different aisle. In July, Amazon and UL — a company that tests products and certifies they meet safety standards — settled a lawsuit against several Chinese firms behind the ebike brand Aipas, which the plaintiffs said used fraudulent UL safety marks in Amazon listings to reassure shoppers worried about battery fires [67]. A federal judge signed a permanent injunction on July 15 barring further use of the mark [67]. WIRED still found ads carrying UL’s logo running on Facebook in mid-July [67].

A safety label and a car alarm sit in the same trap. A certification mark exists precisely because a buyer cannot open the battery, or the alarm, and judge the engineering. “This is a common problem and has been a common problem for quite some time,” said product-safety expert Donald Mays [67]. The US government counted 45 deaths from lithium-ion fires in mobility devices between 2017 and 2024 — the kind of risk the mark is meant to warn against [67]. When the one signal a buyer can read gets counterfeited, the buyer is back to guessing.

The records you can’t take back

Three breaches this week were about the opposite problem — not what you buy, but what leaks once someone else holds your data.

An intruder claimed to have breached the AI music platform Suno, exposing more than 55 million user accounts [2]. Separately, a database with about 23 million records from the earn-money platform Paidwork was dumped online and listed on Have I Been Pwned on July 19; the seller claimed data on over 22 million users [24]. The exposed fields reportedly went well past names and emails to bank account numbers, dates of birth, and passwords stored as bcrypt hashes [24]. Bcrypt is a slow, deliberate way of scrambling passwords that makes cracking far harder — but weak passwords can still fall [24]. Paidwork had not confirmed the breach at the time of reporting [24].

In Australia, Origin Energy — which serves 4.8 million customer accounts — said attackers accessed names, addresses, dates of birth, phone numbers, and partial payment details such as the last four digits of a card [64]. A person claiming to be the hacker told media that 2 million customers’ details were taken, a figure Origin has not confirmed [64][6].

The password is still the front door

Chick-fil-A said attackers broke into customer accounts using a technique called credential stuffing: taking username-and-password pairs stolen from other companies’ breaches and trying them at scale, betting people reuse the same password everywhere [34]. It works because they often do. The chain reset affected accounts’ passwords and removed stored payment methods [34]. This is the through-line of every leaked-password list above: one breach becomes five when the same password unlocks five doors. A different password for each important account, and a second check to log in where it’s offered, breaks that chain.

Meanwhile the defenders’ pile grew. Oracle’s quarterly update shipped 1,449 patches covering 1,434 distinct flaws across 334 products, hundreds rated critical, many exploitable remotely without a login [8][10]. That is a single vendor, in a single quarter — a reminder that “keep it updated” is quietly enormous work for the businesses holding your data.

02 · Lesson · why it matters

When you can't check it, the careful version stops paying

If buyers can't tell a secure product from an insecure one, the safe one costs more for something no one can see — so it loses, and the market fills with the weak version.

A device you never saw, protecting you with a key everyone shares

Two million drivers have an anti-theft box wired under their dashboard. Most don’t know it’s there. The dealer put it in, left it in, and it turns out every one of those boxes is protected the same way. Nobody who bought a car with that box ever got to look inside it. They couldn’t have judged it if they had.

Hold that next to a small ebike case from the same week: a company put a safety-certification mark on its listings, and the mark was fake. The buyer worried about a battery fire had exactly one tool to check the product — a logo — and the logo was counterfeited.

Different aisles, same trap. In both, the thing that matters most is the thing you can’t inspect before you commit.

The market that fills with lemons

An economist named George Akerlof described this trap in 1970, using used cars. Some are solid, some are lemons, and the seller knows which is which — but the buyer can’t tell them apart on the lot. So a careful buyer won’t pay the price of a good car for a car that might be a lemon. They’ll only offer the average.

At the average price, the owner of a genuinely good car walks away — it’s worth more than that. So the good cars leave the market. Now the average quality drops, so the fair price drops, so the next-best cars leave too. The market unravels toward the bottom.

The engine of this is not greed and not laziness. It is one specific thing: the buyer cannot see the quality before they buy. Information, missing at the one moment it would matter.

Security is almost perfectly invisible

Now look at what you actually buy. An app’s real security. A smart lock’s firmware. Whether a company salts and stores your password well or badly. The alarm your dealer chose. You cannot check any of it standing in the shop or scrolling the listing. You often can’t check it after you own it. You find out only when it fails — and often not even then.

That makes security the purest lemon there is. Two apps sit side by side. One team spent three months hardening theirs; the other shipped in a weekend. In the store they look identical — same screenshots, same price, maybe the weekend one is cheaper and prettier. Nothing you can see rewards the three months. So the careful team’s extra cost buys them nothing at the point of sale, and the corner-cutting one wins the download. Do that across a whole market and the safe version quietly stops paying to exist.

That is why “why is so much software insecure?” has an answer that isn’t “engineers are careless.” Much of it is careful. It’s that carefulness is invisible to the person deciding, so it doesn’t get bought.

Labels are the patch, and the patch gets attacked

Every market with this problem invents the same fix: a signal that stands in for the inspection you can’t do. A UL mark on a battery. A certification on a padlock. The US government’s new Cyber Trust Mark for smart-home gadgets. The label is a promise from someone who did look, so you don’t have to.

Which is exactly why the fake UL logo matters more than one ebike brand. The counterfeit doesn’t just lie about one product — it poisons the one tool the whole market has for telling good from bad. If the signal can be faked freely, buyers learn to distrust it, and the market slides back toward guessing. The attack on the label is an attack on everyone’s ability to choose well.

You are the buyer who can’t see

This isn’t a story about other people’s bad purchases. Every device in your home, every app on your phone, every service holding your data is a security lemon you took on trust. The dealer trusted the alarm’s maker. You trusted the dealer. The app store trusted the developer. You trusted the store. Each link handed the judgment to the next, because none of them could actually see inside either.

That chain of trust is not a failure of attention. It is the only way any of us can function — no one can audit the firmware in their car, the code in their bank’s app, and the chemistry in their battery. We all buy blind, all the time. The cost of a hidden lemon doesn’t land on some careless stranger. It lands on the two million drivers who did nothing wrong, and it can land on you.

The arrangement, and how little any seat sees

None of this is a law of physics. That security is invisible at the moment of purchase is partly a choice — about what gets disclosed, what gets labelled, what a maker is made to reveal. Labels, breach-notification rules, and honest certifications are all attempts to drag the hidden quality into the light where a buyer can price it. They serve the buyer, and they also serve the careful maker who finally has a way to prove the work they did. They’re imperfect, and they get gamed, and they’re still the difference between a market and a guessing game.

The humbling part is where it leaves each of us. You cannot personally inspect the safety of most things you rely on, and neither can the dealer, the store, or the regulator inspect all of theirs. Everyone is trusting a signal from someone further down a line they can’t see the end of. Knowing that won’t let you check the box under your dashboard yourself. But it might make you hold your certainty about “I bought the safe one” a little more loosely — because the one thing you couldn’t see is usually the one that counts.

03 · Lab · your turn

The Market for Lemons

Adjust how much a security label can be trusted and watch shoppers drift toward lemons or reward real security.

04 · Hope · carry this

The reason you can't see inside the box under your dashboard is the same reason a university team could — and once they looked, a fix reached millions of cars within days. Every honest label, every breach notice, every researcher who checks what we can't is us slowly building the eyes no single buyer will ever have alone.