6

I've started using rental cars frequently for work and android auto has apparently become common enough that many of the cars I rent have it built in. It could be helpful to me even over the short time period of a car rental but I'm hesitant. Having never used it before I'm not familiar with the ecosystem or potential information security risks that might be associated with its usage on someone else's car. That's pretty much the extent of my question(s):

What, if anything, are the potential risks of using android auto on a rental car/shared vehicle? Are there any steps that can be taken to minimize any potential risks, in particular the risk of any information from my phone (including identifying information about my phone) being left behind for someone else to find?

Improve this question
4
  • I think you could write your own answer from this article: usatoday.com/story/tech/columnist/komando/2015/07/03/… I'm fairly certain Android Auto also syncs all that same data to the car.
    – Steve Sether
    Aug 24, 2018 at 15:40
  • @SteveSether Read the last paragraph in your linked article. I believe that Apple CarPlay simply sends video and receives input from the car; processing is done completely on the phone. No idea for Android.
    – user71659
    Aug 24, 2018 at 17:21
  • 2
    @user71659 I have android auto on my car. I'll check if it has retained data, but I wouldn't exactly trust a usatoday article for complete accuracy.
    – Steve Sether
    Aug 24, 2018 at 21:25
  • @SteveSether Android works in a similar way, processing is done on the phone. Essentially the phone casts the Android Auto interface to the cars infotainment display (using USB)
    – Rolf ツ
    Aug 29, 2018 at 10:56

1 Answer 1

Reset to default
4
+200

I have been an avid user of Android Auto for a while now. I have explored all the ins and outs of this software and have done some security research of my own earlier on. Hopefully sharing my findings will help put your mind at ease and allow you to enjoy your rental and Android Auto. =)

What, if anything, are the potential risks of using android auto on a rental car/shared vehicle? Are there any steps that can be taken to minimize any potential risks, in particular the risk of any information from my phone (including identifying information about my phone) being left behind for someone else to find?

According to this website, the sources of which are credible and verifiable, the only thing the software saves from your phone is an ID that is provided through USB. This allows the software to better serve you by knowing exactly which system it needs to start for your particular device. For example; an iPhone will provide an ID and the software will associate that ID with Apple CarPlay, if you're using an Android phone the software will associate your phone's ID with Android Auto.

Also, the website points out that device IDs can be deleted through "a factory reset of the multimedia system". This might be a good way for your to mitigate the risk of losing your phone ID to a bad guy. (if you consider that a risk at all)

One thing though, Is that if you connect to Android Auto, it may ask you if you'd like to pair your phone through Bluetooth. This, unlike the Android Auto software, can pose different security threats. Often times, Bluetooth enabled media devices built into your vehicle will request to download certain information from your phone that you may not feel comfortable sharing with just anyone who rents the car after you. According to the website: "the amount of information your car's Bluetooth system collects varies by Bluetooth module but typically there is storage for hundreds if not thousands of phone numbers." So, in conclusion, your Bluetooth-enabled risk factor depends on the module installed, but as long as you don't allow a Bluetooth connection with your car you should be A-Okay!

Steps that can be taken to minimize potential risks (i.e., phone book and phone identity leakage)

  1. You would be able to erase your phone's identity from the car's software by "a factory reset of the multimedia system". The method by which you do this will depend on the manufacturer, so your best bet will be to do some searching online for how to do that with your particular system.
  2. Make sure to deny any requests that are made to connect via Bluetooth.

And that should be it! I hope this helps.

Improve this answer
7
  • 1
    Maybe you can add that Android Auto works by casting the Android Auto interface from the phone to the cars infotainment display (using USB). Processing is thus done on the phone.
    – Rolf ツ
    Aug 29, 2018 at 10:57
  • Are you sure that the screen is actually cast from the phone? Or is the UI already present in the software, it just takes input from the phone? Just want to make sure before I add, I knew that the processing was done on the phone but I wasn't aware exactly of how it happens. =)
    – xorist
    Aug 29, 2018 at 11:14
  • 1
    I'm looking for a reliable source that you can add. But I'm quite certain ;)
    – Rolf ツ
    Aug 29, 2018 at 11:37
  • I'm looking for one as well, but I can't seem to find anything about how the software actually works under-the-hood. Maybe we can reverse it? haha jk
    – xorist
    Aug 29, 2018 at 11:39
  • google.com/events/io/io14videos/… This video explains quite a bit, I don't have time to check the video now but looking at the slides only I think it answers most questions.
    – Rolf ツ
    Aug 29, 2018 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.