###### Abstract  
The Connected Automated Vehicle (CAV)'s deployment is proof of the wide evolution of autonomous driving technologies enabling vehicles to gradually dispose of their drivers. Within the scope of smart cities, such innovation has given rise to a new type of CAV: the Automated City Shuttle (ACS). Foreseen as the new paradigm aiming to shape the public transport model, the ACS elicits a plurality of new applications, such as the on-demand service in which a driverless shuttle offers the desired ride without human intervention. However, such a model raises cybersecurity concerns through the numerous attack surfaces and vehicle hyperconnection. This phenomenon was highlighted in several studies on CAVs, but very few research works tackled the specific case of ACSs, whose challenges and risks far exceed those of personal vehicles. The present work offers a comprehensive investigation of cybersecurity attacks, demonstrates a performed risk assessment based on the ISO/SAE 21434 standard, and showcases a penetration test over a real ACS of automation level four (L4) according to the Society of Automotive Engineering (SAE)'s ranking. Based on our experiments, we leverage fundamental cybersecurity recommendations with a focus on the ACS's physical security. automated city shuttles; connected automated vehicles; cybersecurity; ISO/SAE 21434; penetration testing; risk analysis +
Footnote †: journal:  
are also shown to be safer [9], to reduce traffic congestion, and to decrease pollution in comparison to conventional vehicles [10]. More specifically, ACSs are well suited for the transportation of the elderly and people with disabilities or reduced mobility [11]. Therefore, the wide deployment of ACSs could be a paradigm shift in achieving a cheap, reliable, always available, and accessible new way of transport for smart cities. Driven by these advantages, several cities throughout the world have already started testing ACSs in their fleets in multiple pilot projects [12]. However, such technologies introduce multiple security concerns threatening the passengers' safety and security as demonstrated by several researchers. To illustrate, [PERSON] et al. [13] reported attacks on the Chevrolet Camaro; [PERSON] and [PERSON] [14] implemented a remote takeover of the braking and steering systems of a Jeep Cherokee; and [PERSON] et al. [15] demonstrated a blinding attack over the Tesla S sensors leading the vehicle to crash. For an in-depth understanding of the ACS threats, we had the opportunity, under the umbrella of the AVENUE project [16], to investigate, analyse and conduct penetration testing over the L4 vehicle depicted in Figure 1. Our study relies on the Threat Analysis and Risk Assessment (TARA) methodology provided by the standard ISO/SAE 21434 \"Road vehicles--Cybersecurity engineering\" [17]. The methodology supports with building threat scenarios, rating the attacks' impact, and determining the risk related to the ACS's assets. We then elevate the TARA's findings further by performing penetration tests (hereinafter, referred to as pentests) over the vehicle's Global Navigation Satellite System (GNSS) and 4G connections. From the obtained results, we provide our recommendations to mitigate the risks and the identified weaknesses. This paper aims to answer the following research questions:  
**RQ 1**. : _Is the TARA methodology suitable for identifying L4 specific threats?_  
**RQ 2**. : _Would the execution of penetration tests confirm the resilience of the mitigations applied to the high-risk scenarios defined by the TARA?_  
The remainder of this paper is structured as follows: Section 2 discusses related works and identifies knowledge gaps in the domain. Section 3 provides background information on the materials used to perform the TARA approach on the L4 vehicle and describes the implementation methodology of the pentests. Section 4 discusses the obtained results,  
Figure 1: Example of the Automated City Shuttle investigated in the present work.