ELASTIC D2.2: Serverless FaaS with Lightweight Containers

This deliverable presents a secure, privacy-aware, and architecture-agnostic execution framework for WebAssembly (Wasm)-based serverless workloads. It delivers two complementary contributions that address vulnerabilities spanning the entire serverless lifecycle—from deployment to runtime. First, we conduct a large-scale analysis of public serverless repositories, revealing critical risks such as outdated dependencies, insecure configurations, misuse of sensitive parameters, typo-squatting, and the embedding of malicious code within compressed artifacts. Second, we introduce a novel side-channel attack against Wasm applications running inside Trusted Execution Environments (TEEs), demonstrating how system call traces can be exploited to fingerprint embedded libraries or components with high accuracy, enabling stealthy and targeted attacks. Building on these findings, we propose the Serverless Security Toolbox—a consolidated, defence-in-depth collection of techniques and recommendations spanning supply chain security, runtime confidentiality, and secure inter-function communication. By integrating these countermeasures, the framework addresses both deployment-stage and runtime threats, advancing the state of the art in secure and privacy-preserving Wasm-based serverless computing. This work has been carried out under Task 2.2 of the ELASTIC project.