Holy shit. The KARR and SWDS "security" units - designed to help you prevent car theft - are vulnerable for absolute clowntown reasons.

• They bridge BLE to CAN. That means every function of your car is under their control.
• They protect that BLE interface with a key...
• ...which doesn't change between units...
• ...which is stored in plaintext in the mobile app.