DEF CON 34 - Main - How Dealer Installed AntiTheft System Exposes 1M+ Cars - A Schulman, J Yu, Y Wei
Source: YouTube · DEFCONConference · published Nov 6, 2026 · 35:45
UC San Diego researchers found 3 of 6 aftermarket Bluetooth car security systems trivially exploitable, affecting millions of vehicles 3:16.
Key Takeaways:
• BLE's local pairing model doesn't fit vehicle control, so vendors build app-layer security—often botched by aftermarket vendors lacking security teams 1:03
• KARD (Quantum Telematics) uses a hard-coded universal secret key in the app's source, making authentication meaningless; access control is just a UI filter, and disabled systems accept a "change mode" command restoring full control 14:38
• Attacks enable vehicle entry, stranding drivers via immobilizer, and "mayhem" while driving 19:54
• ~2.2 million KARD devices deployed, mostly in Southern California but spreading nationwide and to military bases 21:52
• CarLink BTLR is equally easy to hack—pairing only requires reconstructing a QR code from the public MAC address 28:07
KARD's patch (per-vehicle keys, full no-sale disable) arrived only weeks before disclosure 24:31. Aftermarket devices bypass OEM security, owners often don't know they're installed—if your car has the "CAR ALARM" sticker, apply the patch 32:05.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone. Are you ready for car hacking? [cheering] [applause] >> We're from UC San Diego. And my name is Ebo. >> Just keep going. >> And this is uh this is Aaron, my PhD advisor, and Jerry. >> Random dude. >> Random dude. Okay. So, how are you going to hack cars? So, you can see now we have Bluetooth features for a lot of those cars that controls all the critical parts that you don't want defcon people to messed up with like door locks, horn, lights, immobilizer, even canvas, and ignition. And since it's all BLE, that means every smartphone can be used as a hacking device. Like, you don't need a special gadget for the hack. So they must be super secure by design. Unfortunately, BLE comes with a security model that is not super compatible with vehicle control purpose. And let me expl…