<\/p>\n
Could a small device hidden beneath your dashboard make your car easier to break into? Nancy from Newtown, Pennsylvania, asked me where she should look for the KARR or SWDS “code” in her 2025 Cadillac<\/a> XT5 and 2024 Hyundai Tucson Limited Hybrid.<\/p>\n Here is the first thing you need to know. There is no code to find in your vehicle’s settings. KARR and SWDS refer to aftermarket security hardware that a dealership may have installed before selling the car. SWDS stands for Southwest Dealer Services, the company associated with several KARR-branded vehicle protection products.<\/p>\n The device usually sits beneath the dashboard on the driver’s side. You may also find a KARR or SWDS sticker on the driver-side window.<\/p>\n So, before you start searching through menus or calling the automaker<\/a>, here is how to find out whether your vehicle has one of these devices and what to do next.<\/p>\n 15 SECURITY ESSENTIALS TO KEEP YOUR VALUABLES SAFE FOR SUMMER TRAVEL<\/strong><\/a><\/p>\n CyberGuy Live: Missed “Sick of Spam?” Get the replay and checklist<\/strong><\/p>\n Our free CyberGuy Live class “Sick of Spam?”<\/strong> has ended, but you can still watch the full replay and download our spam-stopping checklist. Kurt “CyberGuy” Knutsson walks you step by step through simple ways to reduce robocalls, spam texts, junk email and unwanted messages. You\u2019ll also learn how to curb political texts, clean up your inbox and spot messages that could put your personal information at risk.<\/p>\n Get the free replay and checklist <\/strong>now at CyberGuyLive.com<\/u><\/strong>.<\/p>\n Computer security researchers<\/a> at the University of California San Diego uncovered a Bluetooth vulnerability affecting at least 2.2 million vehicles. The flaw involves dealer-installed KARR and SWDS security devices. A person standing within about five yards of a vulnerable vehicle could connect to the device through Bluetooth.<\/p>\n From there, an attacker could lock or unlock the doors. The same flaw could silence the alarm, sound the horn or flash the headlights. An attacker could also prevent a parked vehicle from starting. However, the researchers did not report that the flaw could start the engine or shut down a vehicle that was already running. That distinction is important. The Bluetooth flaw alone does not let someone drive away. However, it could quietly unlock the doors. A thief could then use separate tools to create or program a key.<\/p>\n KARR systems are aftermarket vehicle security products sold through participating dealerships. They may include an alarm, GPS tracking<\/a>, remote vehicle controls or an ignition-disabling feature. Southwest Dealer Services uses several product names, including KARR Security, KARR Fusion, KARR BT, KARR S.W.A.T. and S.W.A.T. Dealer. The features vary by product and vehicle.<\/p>\n These devices do not come from Cadillac, Hyundai, Ford<\/a> or another automaker’s factory. A dealership or one of its vendors adds the hardware after the vehicle arrives. Dealers may use the system to protect inventory sitting on the lot. When someone buys the vehicle, the dealer may offer the system as an additional security package. The problem is that some dealers left the hardware connected even when buyers declined the service. As a result, a driver might have a vulnerable device without an active KARR account or any idea that the equipment is inside the car.<\/p>\n The KARR device communicates with a smartphone app through Bluetooth Low Energy. Researchers found that the affected devices relied on the same secret authentication key. Once they recovered that key, they could send commands that vulnerable KARR devices accepted.<\/p>\n Think of it as giving a huge group of devices the same unchangeable password. Once that password becomes known, each device becomes easier to approach. The researchers also found that the devices broadcast recognizable Bluetooth signals. Historical databases containing those signals could reveal where a particular device had appeared. That creates a privacy concern beyond car theft. Someone could potentially use the data to study where a vehicle regularly parks or travels.<\/p>\n UC San Diego researchers found the devices most often in vehicles sold through Honda<\/a>, Toyota, Mazda, Ford and Jeep dealerships in Southern California since 2017. However, that list does not mean other brands are safe.<\/p>\n KARR works with more than 3,000 dealerships nationwide. Vehicles also move around the country through used-car sales, auctions and dealership trades. Therefore, the vehicle’s make and model cannot confirm whether it has the equipment. The dealership that prepared the vehicle for sale matters more than the badge on the grille. A Cadillac, Hyundai or Chevrolet<\/a> could have a KARR system if the selling dealer installed one. A Honda from another dealership might never have received it.<\/p>\n Start with the easy clues before you remove any trim or crawl too far beneath the dashboard.<\/p>\n Look at the lower corners and edges of the driver-side window.<\/p>\n The sticker may say:<\/p>\n A sticker strongly suggests that the dealership installed a related device. However, the absence of a sticker cannot completely clear your vehicle. A dealer or previous owner may have removed the label while leaving the hardware connected. UC San Diego says many affected vehicles have the sticker, rather than every affected vehicle.<\/p>\n Park the vehicle and shut off the engine. Move the driver’s seat back and use a flashlight to look beneath the lower dashboard. Researchers say the device is usually installed underneath the dashboard on the driver’s side.<\/p>\n You may see a small button or indicator light attached to the bottom edge of the dash. Wiring may run from the button behind the dashboard panels. The button shown by UC San Diego is small and easy to miss. It can look like a basic aftermarket alarm switch rather than a modern connected device. Do not pull on the wires or disconnect anything. The module may connect to the ignition system and other vehicle electronics.<\/p>\n Check the purchase agreement, dealer addendum, finance documents and service records.<\/p>\n Search for references to:<\/p>\n The charge may appear as part of a larger dealer protection package. You may also find the product listed with no separate price if the dealer installed it for inventory control.<\/p>\n TESLA HELPED SAVE A DRIVER; IS YOUR CAR READY?<\/strong><\/a><\/p>\n Call the dealership that originally sold the vehicle. This step can help even when you bought the car used from another business. Your VIN appears near the bottom of the windshield on the driver’s side. You can also find it on the registration, insurance card and driver-side door frame.<\/p>\n Ask the dealer: “Can you check this VIN and confirm whether your dealership or inventory vendor installed a KARR, SWDS, KARR BT, S.W.A.T. or other aftermarket security module?”<\/p>\n Then ask these follow-up questions: “Is the device still connected?” “Has it received the firmware update released on July 20, 2026?” “Can you provide the device model and firmware status in writing?”<\/p>\n A vague answer such as “Your factory alarm is fine” does not address the question. You are asking about dealer-installed aftermarket equipment.<\/p>\n KARR says people who never activated the security service can still use the official KARR Security app to check their VIN. Download the app only through the official Apple App Store, Google Play Store or KARR website. Do not use an app link from an unexpected text message, email or online advertisement.<\/p>\n After opening the app near the vehicle, tap the customer service link at the bottom of the screen. The app should guide you through the VIN check and available firmware update. KARR also lists customer support at 800-395-5277<\/strong>.<\/p>\n Nancy’s 2025 Cadillac XT5 and 2024 Hyundai Tucson Limited Hybrid were not among the specific brands UC San Diego researchers said appeared most often. However, that does not rule them out. The device comes from the dealership rather than Cadillac or Hyundai.<\/p>\n Nancy should check each SUV separately. First, she should look for a KARR or SWDS sticker on the driver-side window. Next, she should use a flashlight to inspect the lower edge of the dashboard near the driver’s knees.<\/p>\n She should also review the paperwork from each dealership. If the vehicles came from different dealers, one could have the equipment while the other does not. Finally, Nancy should call both selling dealers with the VINs. She should ask whether either dealership installed a KARR, SWDS or S.W.A.T. module before delivery. If the dealers cannot provide a definite answer, she can use the official KARR app or call KARR support.<\/p>\n Acrisure released a firmware patch<\/a> on July 20, 2026, one day before UC San Diego publicly announced the vulnerability. The vehicle owner must deliver the update to the KARR device through the official KARR Security app. Updating your phone or vehicle infotainment system will not patch the separate module.<\/p>\n An activated system means you purchased or activated KARR service through the dealership.<\/p>\n Follow these steps:<\/p>\n KARR says no additional action is necessary after the app confirms that the latest firmware is installed.<\/p>\n You can still check and update a device that remained in the vehicle after you declined the service.<\/p>\n Follow these steps:<\/p>\n Call KARR support when the app cannot find the vehicle or complete the update.<\/p>\n WAYMO RECALLS ROBOTAXIS OVER CONSTRUCTION-ZONE RISK<\/strong><\/a><\/p>\n You can ask to have the system deactivated or removed. However, I would not turn this into a weekend do-it-yourself project. Researchers warn that removal may require opening the dashboard, cutting wires and restoring connections involving the ignition system or vehicle computers. Disconnecting the wrong wire could stop the car from starting. It might also affect the factory alarm, remote start or another electrical feature. Southwest Dealer Services says an owner can request removal, transfer or deactivation by calling 800-395-5277 and confirming the account information.<\/p>\n Ask the original dealership or a qualified automotive electrical technician to handle the work. Before approving removal, ask the technician how the factory wiring will be restored. Afterward, request written confirmation that the module was removed and the vehicle’s original security functions still work.<\/p>\n We reached out to KARR Security, and a representative from the company provided CyberGuy with the following statement:<\/p>\n “KARR Security maintains rigorous standards to help protect customers\u2019 vehicles. Researchers at UC San Diego identified a vulnerability affecting BLE-based auto theft devices, including a small percentage of KARR devices with certain Bluetooth-related components. The vulnerability described in the research is highly complex and presents a low risk to customers under real-world conditions. Nevertheless, we responded promptly and developed a firmware update to address the issue. We launched this app\/firmware update on July 20, 2026. Active customers may apply the update directly from their phone after securely logging in to the KARR Security app. Vehicle owners of non-active systems can still update via the app using their VIN (last 8 digits) as a validation step. Consumers can find detailed instructions and tutorials for assistance with this firmware on the Customer FAQ section of our website at www.KARRSecurity.com.”<\/p>\n KARR Security added, “To our knowledge, we have not seen this vulnerability used in the real world to break into or steal a vehicle.”<\/p>\n Turning off Bluetooth<\/a> on your phone will not disable the Bluetooth radio inside the KARR module. Deleting the app will not remove the device. Removing the vehicle from your phone’s normal Bluetooth menu will not patch it either.<\/p>\n The KARR module communicates separately from the Cadillac, Hyundai or other factory infotainment system. A Faraday pouch also will not fix this particular problem. Faraday pouches can help block relay attacks involving a key fob. They cannot update or disable hardware installed beneath the dashboard. You need to update the KARR device itself or have a professional remove it.<\/p>\n Car thieves use different methods, so protecting your vehicle requires more than one piece of technology.<\/p>\n When your vehicle has a KARR or SWDS device, install the firmware update as soon as possible. This directly addresses the Bluetooth flaw identified by the researchers. A steering wheel lock or tracker can add protection, but neither one repairs vulnerable software.<\/p>\n Signal jammers can sometimes block the command sent by a key fob. After pressing the lock button, listen for the normal confirmation sound. Look for the lights and pull a door handle before walking away. Also, close every window and take the keys with you. NHTSA recommends checking the doors whenever you leave a parked vehicle.<\/p>\n A steering wheel lock creates an obvious barrier inside the car. It will not stop every determined thief. However, it adds time and makes the vehicle harder to steer. NHTSA includes steering wheel locks among visible devices that can discourage vehicle theft. You can find more ideas in my CyberGuy guide on how to help prevent your car from getting stolen.<\/u><\/a><\/p>\n Store key fobs away from exterior doors, windows and attached garages. A tested signal-blocking pouch can help reduce the risk of a relay attack. In that type of theft, criminals extend the signal from a key inside the house to a vehicle outside. Test the pouch regularly. Put the key inside, close the pouch and stand next to the car. The doors should remain locked when you touch the handle. Remember that a key-fob pouch protects against a different attack. It will not patch a KARR module.<\/p>\n A hidden GPS tracker or Bluetooth tracker may help locate a stolen vehicle. However, do not confront anyone or attempt to recover the car yourself. Give tracking information to law enforcement. An Apple AirTag can provide a backup location signal, although Apple’s anti-stalking alerts may eventually warn a thief that an unknown AirTag is traveling with the vehicle. Read my CyberGuy guide on using an AirTag<\/a> in a vehicle and understanding its limits.<\/p>\n Use a locked garage when one is available. Otherwise, park in a visible area with lighting, foot traffic or a security camera. Avoid isolated corners where someone can work around the vehicle without attracting attention. NHTSA also recommends parking in well-lit areas whenever possible.<\/p>\n A thief may break into a car without planning to steal the entire vehicle. Take phones, laptops, wallets and bags with you. Do not leave a spare key or garage remote inside the car. NHTSA warns that thieves commonly target electronics and other items they can quickly resell.<\/p>\n Nancy’s question highlights the biggest problem with this vulnerability. Many drivers have no idea that a KARR or SWDS device may be hiding in their vehicle. You will not find a KARR code inside your vehicle’s settings. Look for a sticker on the driver-side window and a small aftermarket button below the dashboard. Then check your paperwork and ask the selling dealer to search your VIN. The flaw can unlock a vulnerable vehicle and interfere with its security features from nearby. It cannot start the engine by itself or shut down a moving car. Still, unlocking the doors may give a thief the access needed to try another method. Fortunately, KARR has released a firmware update. Install it through the official KARR Security app. When you no longer want the system, arrange professional removal rather than pulling wires yourself.<\/p>\n Should dealerships have to tell you about every connected device installed in your car, even when you decline to purchase the service? Let us know by writing to us at CyberGuy.com.<\/u><\/strong><\/p>\n Sign up for my FREE CyberGuy Report<\/strong><\/p>\n Copyright 2026 CyberGuy.com. All rights reserved.<\/p>\n<\/div>\n