Loïc Falletta
Founder
Yinkozi
Loïc Falletta is the founder and CEO of Yinkozi, the company behind YinkoShield, a device-trust and execution-evidence technology deployed across millions of endpoints in banking and payment environments.With over 15 years of experience in offensive security and vulnerability research, he works at the intersection of breaking complex systems and building security infrastructure at scale. His work spans mobile devices, cellular communications, and payment systems, supporting major financial institutions across Africa, Europe, and North America.His research focuses on the security boundaries between hardware, firmware, and software, examining how misplaced trust and implementation weaknesses expose critical components to attack.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
The SIM the Baseband Trusts: A Cross-Vendor, Zero-Interaction Memory-Corruption Class in Cellular Basebands
Inserting a SIM is one of the most trusting things a phone does, and that trust runs deepest at the layer users never see. Before authentication, a cellular baseband reads the SIM's self-declared file system (record lengths/entry counts/ATR fields) and repeatedly uses those attacker-chosen values as memory-copy sizes without clamping them to the destination buffer. We call this topology-trust, and show it is not a single bug but a reproducible memory-corruption class.The card is the attacker. A hostile SIM declares its own file geometry and its own access rules, so it can present these files as always-readable and ship with the PIN disabled, and the modem parses attacker-controlled lengths during SIM initialisation, before network authentication, with no user action beyond insertion.We confirmed members across two baseband vendors and three chipsets, from budget Android phones to a bank's cellular payment terminal. We are precise about impact: today these are denial-of-service, and on MediaTek a separate out-of-bounds read that discloses modem memory, not remote code execution, and we show why the class stops there.Breadth, made concrete: MediaTek's EF.PNN parser runs L = record[1]; memcpy(dst, record+1, L) with no clamp and the same length-as-copy-size shape reappears, re-implemented by a different team in a different file with a different record layout (Unisoc's phonebook). Same antipattern, different code: convergent error, not shared source. We will also release the SIM-seeded taint-analysis tooling and methodology that surface these members on a new modem image in hours.
- 15:10
- Thu
- 03 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote