Bluetooth Flaw Exposes 2 Million Cars to Remote Unlocking Across Multiple Brands

Researchers at the University of California, San Diego have discovered a new Bluetooth-based attack that can remotely lock or unlock vehicles and prevent the engine from starting from a distance of approximately 4.5 meters. The vulnerability affects around 2 million vehicles from brands including Honda, Toyota, Mazda, Ford, and Jeep sold since 2017. The issue stems from KARR anti-theft devices installed by U.S. dealerships, which are used for theft prevention and inventory management and allow vehicle control via a smartphone app. Acrisure, the company that manufactures the device, has released a patch to fix the vulnerability. Researchers noted that many vehicle owners are unaware of this security risk.