Bit of a Close Talker: A Practical Guide to Serverless Cloud Co-Location Attacks
Wei Shao
Network and Distributed System Security (NDSS) Symposium 2026 · Day 3 · Network Security
This research transforms serverless cloud co-location attacks from trial-and-error guesswork into a **systematic, repeatable methodology**. By developing a three-phase probing strategy that fingerprints scheduler behavior without any privileged access, the researchers demonstrate how an attacker can reverse-engineer the placement logic of serverless platforms and then exploit those features to reliably achieve co-location with a target victim's functions.
AI review
A methodical approach to turning serverless co-location from guesswork into science. The five-feature fingerprinting framework is clean, the Azure validation is real, and $25 for guaranteed co-location is a compelling price point. However, this is the prerequisite step -- the actual side-channel exploitation is left to prior work, and Microsoft's refusal to classify it as a vulnerability highlights the gap between achieving co-location and demonstrating impact.