The KARR Alarm Flaw: 2.2 Million Cars Sharing One Bluetooth Key

A device most owners did not choose

Researchers at UC San Diego published findings in July 2026 about the KARR Security System, an aftermarket alarm that car dealers install and then sell as an add-on. Their estimate is that around 2.2 million vehicles carry it, across Honda, Toyota, Mazda, Ford, and Jeep models.

The flaw is that every one of those systems uses the same Bluetooth authentication key, and that key can be extracted from the official smartphone app. Anyone within Bluetooth range, roughly ten to thirty metres, who has that key can open the vehicle, immobilise it, or set off the alarm and lights.

The detail that makes this worse is about how the device got there. Dealers frequently install these systems before the sale and present them as a line item. Customers often decline the feature, and the hardware stays in the car anyway, still powered and still broadcasting. The researchers estimate that about half the affected owners never requested it.

So a substantial number of people are driving cars with an internet-of-things device they declined, that they do not know is active, made by a company they have no relationship with.

The five words that make the rest readable

Coverage of this story uses a handful of technical terms as though everyone already shares a definition. Worth fixing that first, because the whole problem becomes obvious once the words are clear.

Bluetooth is short-range radio, built for devices that need to talk to something a few metres away without a cable running between them. Your headphones use it. So does the tyre pressure sensor in each wheel, the hands-free microphone above your rear-view mirror, and quite possibly a fitness band on your wrist. The variant found in nearly every small battery-powered gadget sold today is Bluetooth Low Energy, designed so that a device can run for years on a coin cell by staying quiet most of the time and speaking in very short bursts.

Broadcasting is what a Bluetooth device does when it announces itself to the world. The formal term is advertising, and the picture that word paints is accurate: a tiny packet of data, repeated every fraction of a second, saying roughly “I am here, I am this type of thing, and this is my address.” That list of devices your phone shows when you open the Bluetooth settings screen is nothing more than those announcements, collected out of the air. No connection has been made yet. Anything in range can listen, and listening leaves no trace anywhere.

A key is a long number that two devices both know and that nobody else is supposed to. Think of it as a password machines use on each other, far longer than anything you would ever type, and never shown to a human being. When the alarm decides whether to open your doors, the question it asks is whether the thing talking to it can prove it knows that number.

Pairing is the introduction ceremony where two devices agree on a key. The button you hold on a new speaker until the light flashes, the six digits your laptop displays when you connect a keyboard: those steps exist so the key gets created fresh, in that moment, for that specific pair of devices and nothing else.

Firmware is the software living inside the gadget itself, as distinct from the app on your phone. An app can be replaced overnight through an app store. Firmware usually needs a deliberate update process, and plenty of cheap hardware ships without one at all, which means the code inside is the code it will die with.

Hold those five in your head and the research findings become simple to state. The key was identical everywhere and stored somewhere readable. The broadcast never changes, so it works as a name for the car. And the firmware has no route by which a fix could reach it.

How a device you turned down ends up wired into the car anyway

The technical failure is the part engineers find interesting. For owners, the stranger fact is that roughly half of them never agreed to have the thing at all, and that has a thoroughly mundane explanation.

Dealers buy accessories in bulk and fit them to cars on the lot before any buyer exists. Rustproofing, paint sealant, fabric protection, wheel locks, and alarms all work this way. Fitting them early is cheaper than fitting them on demand, and it makes the accessory far easier to sell, because a salesperson can point at something already present rather than describe something hypothetical. That second sticker on the window, listing a “protection package” and its price, is the visible end of the arrangement.

When a customer declines, the sale still goes through. What does not happen is removal. Taking the unit out means an hour of a technician’s time, undoing splices cut into the wiring loom during fitting, and an hour of labour on a car that has already sold is money the dealer will not spend. The line item vanishes from the invoice. The hardware stays exactly where it is, wired to the battery, drawing power whenever the car has power.

That leaves an odd category of object: a device physically present and electrically live, yet contractually absent. Nobody owns the relationship. The dealer considers the matter closed because you were not charged for it. The alarm manufacturer has no record of you, since you never registered, never downloaded the app, and never became a customer. Your carmaker knows nothing about the unit because it appeared after the vehicle left their control.

Used cars make all of this quieter and worse. A second or third owner inherits the hardware with no paperwork, no window sticker, and no memory of a conversation in a finance office. Nothing about the car looks unusual from the driver’s seat. A small light blinks somewhere on the dashboard, which most people read as a factory feature, and the alarm may never once have gone off in a way anyone noticed.

None of this requires anybody to behave badly. Every step is a normal commercial decision, made by someone optimising their own small part of the process. The result is still a radio you did not choose, running on your battery, announcing your car to anyone who cares to listen.

Why a shared key is such a serious mistake

Every lock needs a way to tell an authorised person from an unauthorised one. In a Bluetooth device that job is done by a cryptographic key: the car and the app both know a secret, and the car opens for anyone who can prove they know it.

The correct design gives every individual device its own secret, generated during manufacture or when the app is first paired. Recovering the key from one car then tells you nothing about any other car. That is how modern key fobs, hotel door locks, and payment cards all work.

Using one key across the entire product line makes the manufacturing simpler and turns the whole fleet into a single lock. One person extracts the key once, from an app anyone can download, and every device ever shipped is opened. There is no way to fix that for an individual owner, because your car’s security now depends on a secret that is loose in the world.

Extracting a key from a phone app is not exotic work. Apps are unpacked and inspected routinely by security researchers, and a key stored in the app has to be readable by the app, which means it is readable by anyone examining it.

Shared key and paired key, side by side

Since the gap between those two arrangements carries the entire story, laying them out next to each other beats describing them one after the other.

Picture a block of flats where the developer worked out that cutting one key pattern was cheaper than cutting a hundred. Every front door in the building accepts the same key. The arrangement works fine for years, right up to the afternoon a resident copies theirs at a hardware shop and posts a photo of the cut online. No locksmith visit fixes that for one flat, because the flaw lives in the design, and the design is in every door.

Question	One key shared across the product line	A key created when you pair
Where does the secret come from	The factory, identical in every unit	Generated by your device and your phone during setup
Who else holds a copy	Every owner, plus anyone who read the app	Only your two devices
What an attacker needs	A download and an afternoon	Physical access to your device at setup time
If the secret leaks	Every unit ever made is affected	One unit is affected
Can it be fixed for you alone	No	Yes, pair again and the old key dies
What it costs the manufacturer	Nothing	A per-unit step on the production line

That last row explains why anybody ever chooses the left column. Generating, recording, and loading a distinct secret into every unit means keeping a database of secrets, handling units that fail the step, and supporting owners who need a reset years later. Skipping it saves real money at the factory and costs nothing at all until the day somebody examines the design in public.

Drawn out, the shared-key arrangement looks like this. Every arrow carries the same secret, and one of those arrows points at a public app store.

Proper pairing produces a different shape, and the difference is visible at a glance: nothing connects the app store to any individual device.

Read as plain text, each diagram says one thing. In the first, the interesting arrow runs from a public download to every car ever fitted. In the second, that arrow cannot be drawn, because the copy of the app sitting in the store carries nothing worth taking.

The tracking problem underneath

The door-opening flaw is the headline, and the researchers found a second issue that will outlast it.

The device broadcasts over Bluetooth constantly, and that broadcast includes an identifier. Anything nearby that listens for Bluetooth can record that identifier along with a time and a location. Phones do this. So do a variety of apps and community projects that build maps of wireless signals, the largest of which, WiGLE, has collected billions of observations contributed by volunteers driving around with scanning software.

Which means the movement history of a specific vehicle can potentially be reconstructed from public data, by matching one identifier across many sightings. No hacking is involved. The information was broadcast, somebody wrote it down, and it is searchable.

That risk does not depend on the shared key and will not be fixed by a key update. Any device broadcasting a constant identifier has this property, which is why phones and modern car systems randomise their Bluetooth addresses at intervals.

The Bluetooth standard has a name for the fix. Devices that care about privacy use what the specification calls a resolvable private address, a fake address recomputed from a secret that only paired devices hold. The recommended rhythm is a new address roughly every fifteen minutes. Your phone does this. Your headphones probably do this. A cheap alarm module with no privacy design does not, which is how one identifier ends up following a car around for a decade.

What could go wrong, in specific terms

Abstract risk is easy to shrug at, so three concrete situations are worth walking through. The third one is the one most people underestimate.

The car park sweep. Somebody walks a multi-storey car park with a laptop in a bag or a phone running a short script. Every few metres the software recognises a familiar broadcast, sends the key, and a door lock clicks open. Nothing gets forced, no glass breaks, and no alarm sounds, because for as long as they hold the key the alarm answers to them. What leaves the car is whatever was inside it: a laptop in the footwell, a bag on the back seat, the garage remote clipped to the sun visor, the registration documents in the glovebox with your home address printed on them. The published findings describe opening doors, immobilising the vehicle, and setting off the alarm and lights. Driving the car away would require beating the carmaker’s own immobiliser, a separate and considerably harder problem. Contents theft at volume, with no visible break-in, is the realistic version of this.

The claim nobody believes. You report the theft of your belongings. An assessor looks at intact glass, undamaged locks, and a security system that logged nothing at all. Insurers behave reasonably here, pattern-matching against a fraud they see constantly, and “no forced entry” sits near the top of that pattern. Explaining that a third-party alarm you never ordered used a key described in a research paper is a conversation you will hold from a weak position, with paperwork you may not even possess. Whatever else you take from this article, keep any evidence that the module existed and was removed.

The person who wants to know where you are. An ex-partner, a colleague, someone who once sat in your passenger seat for twenty minutes. They need half a minute with a free scanning app to write down the identifier your car announces, and after that the identifier functions as your name. Any place they can leave a cheap scanner, a windowsill near their own front door, a bag left near where you park at work, becomes a checkpoint that quietly records when your car passed. Public wardriving databases open a second route, since volunteers have spent years driving around with scanning software, mapping wireless signals into collections that carry timestamps and coordinates.

The first two risks end on the day the hardware comes out of the car. So does the third, which is the whole argument for removal rather than deactivation. A module that has been disconnected from the door locks while still drawing power keeps announcing itself perfectly happily, and that broadcast was always the harder problem to undo.

How somebody gets the key out of an app

It helps to understand why “the key was in the app” is such a predictable failure, because the same reasoning applies to every connected gadget you will ever buy.

An app on your phone is a file. Anyone can download it, and once downloaded it can be taken apart the way you might take apart a radio to see what is inside. The tools for this are free, widely documented, and used daily by security researchers, app developers debugging their own work, and people building compatible software.

If the app needs to prove to your car that it is authorised, it has to know the secret. And anything the app knows, a person examining the app can find. Developers sometimes try to hide the secret by scrambling it or burying it in an unusual place, which raises the effort from minutes to hours and does not change the outcome.

The design that avoids this is called pairing. Instead of shipping a shared secret in the app, the device and the app agree on a fresh secret the first time they are introduced, usually while you hold a button or enter a code shown on the device. That secret exists only on your device and your phone. Somebody who takes apart the app learns nothing, because the app itself did not come with anything worth learning.

Pairing has been standard practice in Bluetooth for well over a decade and is what your headphones, your fitness tracker, and your car’s own key fob all do. Using a single key across an entire product line is a shortcut that saves the manufacturer the trouble of managing per-device secrets during production.

The three ways devices introduce themselves

Pairing came up above as the alternative to a shipped key. Bluetooth actually offers several different introduction ceremonies, and working out which one a gadget used tells you a great deal about how much thought went into it.

Since version 4.2, the standard has included a mode called LE Secure Connections. Underneath sits a mathematical arrangement that lets two devices agree on a shared secret over open air while somebody recording the entire conversation learns nothing useful from it. The maths holds up. What varies between products is how the two devices confirm they are talking to each other rather than to an impostor sitting in between.

Method	What you do during setup	Stops eavesdropping	Stops an impostor in the middle
Just Works	Nothing; the device simply connects	Yes	No
Passkey Entry	Type a six-digit number shown on one device into the other	Yes	Yes
Numeric Comparison	Both screens show a number; you confirm they match	Yes	Yes

Just Works exists for a genuine reason. Plenty of devices have no screen and no keypad, and a heart rate strap cannot display six digits to anybody. The trade is honest as long as everyone understands it: the conversation stays private, though neither side has proved who it is talking to. Somebody positioned between the two devices at that first introduction can end up paired with both, relaying messages and reading everything that passes.

Passkey Entry closes that gap with something an attacker in the middle has no way to guess. Six digits leaves one chance in a million of a lucky hit, which is enough to make the attempt pointless.

You can work out which method your own devices used from memory alone. Held a button until a light flashed, then it connected? Just Works. Typed a number your car displayed into your phone? Passkey Entry. Compared two numbers on two screens and tapped yes on both? Numeric Comparison.

A shipped key skips the ceremony entirely. The device and the app never agree on anything, because the agreement was made once at the factory on behalf of every unit that would ever exist. From the outside the experience feels smooth, and smoothness is the symptom worth noticing. When a security device connects to your phone with no ceremony at all, no button, no code, no confirmation tap, then either it settled for Just Works or it arrived with a key already inside it.

What a well-made connected device looks like

Since more of these will keep arriving, it is worth knowing what separates the reasonable ones from the rest. Four properties cover most of it.

Each unit has its own credentials, established at pairing rather than shipped in the app. You can usually tell from the setup process: if you had to hold a button on the device, or type a code it displayed, pairing happened. If the app simply found the device and connected, be suspicious.

The device can be updated, and updates actually arrive. Ask before buying: how are updates delivered, and how long is support promised. Manufacturers that answer clearly have thought about it. Manufacturers with no answer have told you the product is finished at the moment of sale.

The identifier it broadcasts changes over time. This one is hard for a buyer to verify directly, and the proxy is whether the manufacturer is a serious company with security documentation. Phones and modern cars rotate their Bluetooth addresses specifically to prevent the tracking problem described above.

Losing the device does not lose you access to the thing it protects. A smart lock with a physical key backup, an alarm you can disable at the vehicle, a tracker whose absence does not immobilise anything. Devices that become single points of failure convert a manufacturer’s bankruptcy into your problem.

A checklist you can run inside the shop

Those four properties are the theory. Turning them into questions you can put to a salesperson, or answer for yourself from a product page, takes about two minutes and saves a great deal later.

1. How does it pair? Look through the setup instructions for a button press, a code, or a confirmation step. A product page that presents setup as “download the app and you are done” has quietly told you something.
2. Who updates it, and until when? Ask for a date. “We support products for five years from the last sale” counts as an answer. So does silence, in its own way.
3. Can I get in without it? A smart lock with a keyhole, an alarm with a physical override at the vehicle, a bike tracker that does not stop the bike. If losing your phone means losing access to the thing, walk away.
4. What happens when the company folds? Devices that need a distant server in order to function stop functioning. Ask whether the product works with no internet connection.
5. Is there anywhere to report a flaw? Manufacturers who take this seriously publish a contact address, often security@ their own domain, or a page describing how they handle reports. Its presence means somebody there has already imagined the day a researcher calls.
6. Does it broadcast constantly, and does the identifier change? Hard for a buyer to verify directly. The usable proxy is whether the company documents anything about privacy at all.
7. What is the way back out? If you change your mind after a week, can the fitting be reversed, and who pays for that.

Write the answers down before buying anything that touches a door, a lock, or a vehicle. The exercise takes longer than most people spend on the decision, and it quietly filters out a surprising share of what sits on the shelf. A manufacturer who cannot answer the second question has told you the product is finished at the moment of sale, and that anything discovered about it afterwards becomes your problem alone.

How the ways into a car compare

Cars have accumulated access methods over the decades without ever retiring the old ones, so most vehicles on the road carry three or four at once. Setting them side by side shows where an aftermarket alarm actually sits.

Method	How it proves you belong	Main weakness	Who can fix a flaw
Metal key	The physical shape of the cuts	Copying, picking, a clear photo of the key	A locksmith, one car at a time
Rolling-code fob	A code that changes with every press and never repeats	Older systems with weak code generation	The carmaker, via recall or dealer visit
Keyless entry	The fob answers a challenge when it is near the car	Relay attacks, where two people stretch the range from your hallway to your driveway	The carmaker; newer systems time the signal to defeat it
Phone as key	A credential held in the phone’s secure hardware	A lost phone, or an account takeover	Carmaker and phone maker, over the air
Aftermarket alarm with a shipped key	Knowing a number that was published	The number is public	Nobody, in practice

The pattern running down the final column matters far more than any individual row. Every method except the last belongs to an organisation with a process for repairing it. Carmakers run recalls. Phone makers push updates every month. Locksmiths rekey cars for a fee. An accessory fitted by an intermediary sits outside all of those arrangements, which is exactly why the advice for this particular device is physical removal rather than patience.

Worth noticing as well that adding an access method never subtracts one. A car with keyless entry still hides a metal blade inside the fob and still has a lock cylinder in the driver’s door. Adding a fifth route in means the security of the whole car equals the security of whichever route is weakest, and that route is now a third-party box tucked behind the dashboard, built to a price, supported by nobody.

Why nobody is going to fix this for you

Car manufacturers issue safety recalls and, increasingly, software updates for the systems they build. A dealer added this device, sourced from a third-party manufacturer, and it sits outside every process a carmaker uses to push fixes. The vehicle’s own software has no knowledge of it.

The alarm manufacturer would have to publish an app update and some way of re-keying installed hardware, and re-keying a device with no internet connection generally means a physical visit. For a product sold years ago, at a price that did not include a support programme, that is a hard economic case.

The practical consequence is that this is a problem owners will have to resolve themselves.

What to do about it

Find out whether you have one. Look for a small LED, often blinking, mounted in the dashboard or near the driver’s door, that is separate from your car’s built-in security light. Check your purchase paperwork for a line item mentioning an alarm, security system, or anti-theft package, which is where these appear even when you declined the feature. If you bought the car used, the paperwork may not be yours to check, so the light is the better signal.

You can also look for it directly. A Bluetooth scanning app on your phone, of which there are many free ones, will list nearby devices. Sit in the car with the engine off and see what appears. A device that is present when you are in your car and absent when you walk away from it is attached to your car.

If you find one, ask the dealer to remove it. Removal is straightforward for a technician and this is a reasonable request to make, particularly if you declined the feature at purchase. Be specific that you want the hardware removed rather than deactivated, since a device that is unplugged from its function may still be powered and broadcasting.

If removal is refused or impractical, an auto electrician can do it, usually inexpensively. Weigh that cost against the fact that the device provides you no security benefit while providing a stranger a way into your car.

Step by step: working out whether your car has one

That advice is short because the actions themselves are short. Working through them in order takes an evening, and most people can stop after the first two steps.

1. Check the window sticker if you kept it. Dealer-fitted accessories appear on a second sticker alongside the official price label, usually headed something like “dealer installed options” or “protection package”. An alarm, security system, or anti-theft package on that list means the hardware went in, whether or not you paid for it.
2. Read the purchase agreement. The same names turn up there, sometimes with the price struck through or reduced to zero. A struck-through line is the strongest signal available: the item was fitted, then taken off the bill.
3. Look for the light. Sit in the driver’s seat after dark with the engine off and the doors closed. Your car’s factory security indicator blinks somewhere on the dashboard or centre console, usually small and red. A second blinking LED, commonly mounted in the A-pillar beside the windscreen, in the driver’s door trim, or drilled into the dash near the steering column, belongs to an aftermarket unit. Factory lights sit flush in a moulded panel. Aftermarket ones sit in a drilled hole with a visible plastic bezel around them.
4. Look for a hidden override button. These installations almost always include a small push button tucked under the dash, near the fuse panel or the bonnet release, used to bypass the system when the remote fails. Finding one confirms the diagnosis on its own.
5. Scan for it over Bluetooth. The next section covers exactly how.
6. Call the selling dealer with your registration or VIN. Ask what accessories were fitted to this vehicle before delivery. Franchised dealers keep that record for years, including for cars they sold to somebody else entirely.
7. Ask a mechanic at the next service. Anyone who has had the lower dash panel off will have seen the box sitting there, and the question costs nothing to ask.

For a used car with no history attached, steps three, four, and five carry almost all of the weight. The paperwork trail simply does not exist for a second owner, so the physical evidence has to do the work instead.

Scanning for Bluetooth devices with a phone

A scanning app turns your phone into the same sort of listener the tracking problem depends on, which makes it a useful way to see your own car the way a passing stranger would. The apps cost nothing, and none of this is invasive: you are reading announcements that are already being shouted into open air.

1. Install a scanner. nRF Connect, published by the chip manufacturer Nordic Semiconductor, and LightBlue are the two most commonly recommended, both free on iOS and Android. Either does the job. Skip anything that wants you to create an account.
2. Take a baseline reading at home, away from the car. Open the app and let it run for a minute in your kitchen. Note what appears: a television, headphones, a smart speaker, a neighbour’s watch through the wall. Knowing your normal background makes the car scan readable rather than alarming.
3. Sit in the car with the engine off. Doors closed, ignition off, phone resting in your lap. Start a fresh scan and let it run for a full two minutes. Devices appear as a name, an address, and a signal strength.
4. Read the signal strength. The number is negative and measured in decibels. Anything from about -40 to -55 is within arm’s reach. Around -80 to -95 means far away, or close but behind metal. The device you are hunting for will read strong, because it sits perhaps a metre from you behind the dashboard.
5. Ignore the obvious entries. Your own phone never lists itself. Your headphones, your watch, and the car’s own hands-free system all appear and are easy to recognise by name.
6. Note anything unnamed or oddly named. Many small modules advertise no friendly name at all and show up as an address only, a string of hex digits along the lines of 4C:2A:8E:.... Perfectly normal for cheap hardware, and also precisely what an aftermarket alarm module looks like.
7. Do the walk-away test. Leave the scan running, get out, and walk fifty metres. Devices belonging to the car fade and drop off the list. Devices in your pocket or your house behave differently. Walk back and watch your candidate reappear.
8. Repeat once somewhere else. If the same device follows you across two locations on two different days, it travelled with you, and things that travel with your car are attached to your car.

The test proves attachment rather than identity. Knowing that a persistent Bluetooth device rides around in your car is enough to justify asking somebody to drop the lower dash panel and look. A mechanic will identify the box in about thirty seconds, and the model number printed on it settles the question entirely.

What to say to the dealer

Asking for removal goes better when the request arrives specific and unemotional. Service departments field vague complaints all day long and tend to move faster on precise ones.

Open with the fact rather than the grievance. Something close to this works:

“There is an aftermarket alarm module fitted to this car, a dealer-installed system rather than the factory one. I did not order it and it was not on my final invoice. I would like the module physically removed and the wiring returned to standard. Can you book that in?”

Four things belong in the request, and leaving any of them out invites a half-finished job.

• Physical removal rather than deactivation. Say those words out loud. A technician who unplugs the unit from the door lock circuit while leaving it connected to power has fixed nothing at all, because the radio carries on broadcasting.
• The wiring restored. Ask that splices be removed or properly rejoined rather than left taped up behind the dash. Aftermarket fitting typically taps into the ignition, door lock, and starter circuits, and sloppy removal creates faults that surface months later.
• A note on the invoice. The phrase “aftermarket security module removed” written onto the service record protects you afterwards, with an insurer, a future buyer, or the next mechanic who wonders about a stray wire.
• The part handed back. Asking for the removed module in a bag confirms it genuinely left the car. It also hands you the model number, which is useful if you want to look up what the thing actually was.

Expect one of three responses. Some dealers simply do it, particularly where the customer declined the accessory at purchase and the paperwork shows as much. Others quote for the labour, and roughly an hour of shop time is a normal figure. A few insist the unit cannot be removed, which is rarely true and usually means nobody in the workshop fancies the job that week.

An independent auto electrician makes a good fallback and is often the better option regardless, since pulling out third-party wiring is routine work for that trade. Bring your paperwork, ask for a written quote, and mention that the unit sits behind the dash on the driver’s side.

If the dealer sold you the car and you declined the accessory in writing, your position is stronger than most people assume. Fitting hardware a customer refused and then leaving it powered in their vehicle is awkward to defend, and pointing that out calmly tends to shorten the conversation considerably.

Questions people actually ask

The same handful of questions surfaces every time this subject comes up, and most of the answers are less dramatic than the questions suggest.

Does my insurance care? In two ways. If your policy lists an approved alarm as a condition of cover or as the basis of a discount, removing an unapproved third-party unit changes nothing, because that unit was never the approved one. Check the wording for a named make and model; if it names your factory system, you are fine. The second way matters more. A contents theft with no forced entry is harder to claim, so keeping a dated invoice showing the module existed and was removed is cheap insurance against a bad conversation later.

Can I just pull the fuse? Usually not, and never reliably. These units are typically wired straight to a constant power feed rather than through a labelled fuse, deliberately, so that a thief cannot silence the alarm by opening the fuse box. Even where a fuse does exist, cutting power to a module spliced into the door lock and starter circuits produces behaviour nobody wants, from doors that stop responding to an engine that will not crank. Removal by somebody who can see the wiring is the sane route.

Does this affect my key fob? No. Your car’s own remote is a separate system built by the carmaker, using a code that changes with every press and never repeats. The aftermarket alarm runs alongside it with its own remote, often a second fob on your keyring that you may have assumed was a spare. The published flaw concerns the alarm’s Bluetooth interface and its app, and it says nothing whatever about your factory fob.

What about my car’s built-in connected app? Different animal, different risk profile. Carmaker apps talk to the vehicle over the mobile network through the manufacturer’s own servers, so the security rests on your account rather than on how close somebody is standing. An attacker needs your credentials, not proximity. Give that account a strong unique password and a second authentication factor, and remove your access when you sell the car. Previous owners retaining app control of a vehicle they no longer own is a recurring and thoroughly avoidable problem.

Is my rental car affected? Quite possibly, and there is nothing you can do about the hardware in a car you hand back on Friday. Treat any rental as a vehicle whose history is unknown to you. Take valuables with you, leave no documents in the glovebox, and if you pair your phone to the car’s system, delete the pairing before you return it. Leased cars are worth checking properly, because you can raise the question with the leasing company, who holds the paperwork you do not.

If I switch off Bluetooth on my phone, does that help? No. The alarm broadcasts under its own power regardless of what your phone happens to be doing. Your phone’s Bluetooth setting governs your phone and nothing else in the car.

Does removing it void my warranty? Removing a third-party accessory has no bearing on your vehicle warranty, provided the wiring goes back to standard. Damage caused by the original fitting is a separate conversation, and one worth having with whoever did the fitting rather than with the carmaker.

I actually use the alarm. What now? Then you are trading a feature against an exposure, which is a legitimate choice to make with open eyes. If you keep it, park somewhere the car is not a target, leave nothing valuable inside, and accept that the alarm offers you no protection against anybody who has read the research. Most owners who look closely discover they have never once used it.

What to do this week

None of this needs a whole weekend. The work splits into short tasks spread across a week, and the first two produce most of the value.

• Tonight: sit in the car after dark with the engine off and look for a second blinking LED. Two minutes.
• Tomorrow: install a Bluetooth scanner and run the walk-away test described above. Fifteen minutes.
• This week: dig out the purchase paperwork and look for an alarm, security system, or protection package line, struck through or otherwise. Ten minutes.
• This week: if anything turned up, phone the selling dealer with your VIN and ask what was fitted before delivery. One call.
• Before your next service: decide whether you want removal, then add it to the job sheet in writing rather than mentioning it in passing at the counter.
• Whenever you next stop at the car: empty the glovebox of anything carrying your home address, and stop leaving the garage remote clipped to the visor. Sound practice regardless of what you find.

If the scan comes back clean and the paperwork shows nothing, you are finished, and fifteen minutes bought you certainty about a question most owners never think to ask. If something did turn up, an hour of somebody’s labour ends the problem permanently, which is a better resolution than most security news ever offers.

The general lesson for anything with a radio

The specific product will fade from relevance. The pattern is going to keep appearing, because the market for cheap connected add-ons keeps growing and the security engineering behind them frequently does not.

The questions worth asking before accepting any connected device are short. Who made it, and are they still in business. Does it receive updates, and how would I know. Does it broadcast anything continuously. And, most usefully, what happens if it fails: does my car still work, does my door still open, or have I introduced a new way to be locked out.

Devices added by an intermediary rather than the manufacturer deserve extra scepticism, because they inherit none of the manufacturer’s support processes and often none of their engineering standards. A dealer-installed alarm, a landlord-installed smart lock, and an insurer-supplied driving monitor all fall into this category. The organisation that put the device on your property is usually not the organisation that would have to fix it.