Plain‑Text Authentication Key in KARR Aftermarket Car Alarm Lets Any Attacker Unlock Millions of Vehicles
What Happened — Researchers discovered that every KARR Security System alarm (installed in ~2.2 M U.S. vehicles) stores the same authentication key in plain text inside the companion smartphone app. Extracting that key once allows an attacker within five feet to unlock doors, disable ignition, and even trigger “mayhem” mode across multiple cars. The devices also broadcast Bluetooth identifiers that can be harvested to build detailed location histories.
Why It Matters for Compliance & Audit Readiness
- The flaw is a textbook example of a control gap that a SOC 2‑aligned continuous‑compliance program is built to detect, document, and remediate.
- Mapping this vulnerability to the Security and Availability Trust Services Criteria (e.g., CC6.1 – “Logical access is restricted to authorized users”) provides audit‑ready evidence that you are actively monitoring third‑party hardware for insecure defaults.
- Verisq’s Control Mapping capability can automatically collect firmware‑version inventories and authentication‑key management evidence, turning a remediation sprint into continuous audit proof.
Who Is Affected – Automotive aftermarket suppliers, OEM dealerships, and any organization that integrates third‑party telematics or alarm hardware into vehicles.
Recommended Actions
- Inventory all aftermarket Bluetooth alarm devices and verify unique authentication keys per unit.
- Apply the vendor‑issued firmware update immediately; document the patch status as part of your change‑management controls.
- Incorporate periodic cryptographic‑key rotation checks into your continuous‑monitoring workflow to satisfy SOC 2 CC6.1 evidence requirements.
Source: Malwarebytes Labs
Technical Notes
- Attack vector: exploitation of a hard‑coded authentication key stored in clear text within the KARR mobile app.
- No CVE assigned; the vulnerability is a design/implementation flaw spanning devices shipped since 2017.
- Data types exposed: vehicle location (via Bluetooth identifiers) and control of vehicle functions (lock/unlock, ignition, horn, lights).