I have been an avid user of Android Auto for a while now. I have explored all the ins and outs of this software and have done some security research of my own earlier on. Hopefully sharing my findings will help put your mind at ease and allow you to enjoy your rental and Android Auto. =)
What, if anything, are the potential risks of using android auto on a rental car/shared vehicle? Are there any steps that can be taken to minimize any potential risks, in particular the risk of any information from my phone (including identifying information about my phone) being left behind for someone else to find?
According to this website, the sources of which are credible and verifiable, the only thing the software saves from your phone is an ID that is provided through USB. This allows the software to better serve you by knowing exactly which system it needs to start for your particular device. For example; an iPhone will provide an ID and the software will associate that ID with Apple CarPlay, if you're using an Android phone the software will associate your phone's ID with Android Auto.
Also, the website points out that device IDs can be deleted through "a factory reset of the multimedia system". This might be a good way for your to mitigate the risk of losing your phone ID to a bad guy. (if you consider that a risk at all)
One thing though, Is that if you connect to Android Auto, it may ask you if you'd like to pair your phone through Bluetooth. This, unlike the Android Auto software, can pose different security threats. Often times, Bluetooth enabled media devices built into your vehicle will request to download certain information from your phone that you may not feel comfortable sharing with just anyone who rents the car after you. According to the website: "the amount of information your car's Bluetooth system collects varies by Bluetooth module but typically there is storage for hundreds if not thousands of phone numbers." So, in conclusion, your Bluetooth-enabled risk factor depends on the module installed, but as long as you don't allow a Bluetooth connection with your car you should be A-Okay!
Steps that can be taken to minimize potential risks (i.e., phone book and phone identity leakage)
- You would be able to erase your phone's identity from the car's software by "a factory reset of the multimedia system". The method by which you do this will depend on the manufacturer, so your best bet will be to do some searching online for how to do that with your particular system.
- Make sure to deny any requests that are made to connect via Bluetooth.
And that should be it! I hope this helps.