  Last-level cache side-channel attacks have been mostly demonstrated in
highly-controlled, quiescent local environments. Hence, it is unclear whether
such attacks are feasible in a production cloud environment. In the cloud, side
channels are flooded with noise from activities of other tenants and, in
Function-as-a-Service (FaaS) workloads, the attacker has a very limited time
window to mount the attack. In this paper, we show that such attacks are
feasible in practice, although they require new techniques. We present an
end-to-end, cross-tenant attack on a vulnerable ECDSA implementation in the
public FaaS Google Cloud Run environment. We introduce several new techniques
to improve every step of the attack. First, to speed-up the generation of
eviction sets, we introduce L2-driven candidate address filtering and a Binary
Search-based algorithm for address pruning. Second, to monitor victim memory
accesses with high time resolution, we introduce Parallel Probing. Finally, we
leverage power spectral density from signal processing to easily identify the
victim's target cache set in the frequency domain. Overall, using these
mechanisms, we extract a median value of 81% of the secret ECDSA nonce bits
from a victim container in 19 seconds on average.
