Matteo Vinci Relatore
Matteo Vinci, si occupa a tempo pieno, di consulenze informatiche forensi presso Forenser Srl, producendo perizie in ambito civile e penale per privati, aziende, Studi Legali, Autorità e Polizia Giudiziaria.
Collabora e ha collaborato, con le Forze dell'Ordine e i massimi esperti di Digital Forensics a livello Nazionale.
Ha partecipato come speaker, insieme a esperti del settore, illustrando tecniche di OSINT, computer e mobile forensics, esponendo tecniche per la cristallizzazione, conservazione, studio e analisi di evidenze digitali.
E' certificato Computer Hacking Forensic Investigator (CHFI) ed è Istruttore Certificato EC-Council (CEI). Tiene lezione a contratto in master universitari per UNITO (Corep) e corsi di formazione presso POLIMI.
Lista Talk
- N-Click N-Day. What's Up? Since May 2026, cases of WhatsApp compromise have been reported both in Italy and in several other countries. Every report shared the same characteristics: an up-to-date WhatsApp application, an outdated iOS version, fraudulent messages requesting money sent to the victim's contacts without ever appearing in the chat on the phone, and a list of linked devices showing no anomalies. Starting from the first report, we began collecting diagnostic logs (sysdiagnose) and full filesystem forensic images in order to investigate the compromise through forensic analysis and answer two questions: what method was used to compromise the devices, and how was WhatsApp manipulated to carry out the fraud? After several weeks of research, we have reached a number of concrete results: based on the analysis of the collected evidence, the WhatsApp compromise appears to be linked to Coruna, a sophisticated malware discovered a few months earlier by researchers at the Google Threat Intelligence Group and iVerify. The outdated iOS versions found on all affected devices are consistent with the exploitation of N-day vulnerabilities rather than zero-days. In this talk we will cover three aspects: the attack chain that led to the compromise of the iOS devices; the inner workings of the WhatsApp module used by Coruna, including the techniques and methodologies the malware employed to hijack the victim's WhatsApp session in order to send fraudulent messages to their contacts; and, finally, a potentially new technique used to clone WhatsApp sessions. - 11:30/12:15, 21 Nov 2026