Dive into OS X

Apple’s iPhone is one of the most anticipated — and hyped — products ever. And with any huge product launch, the scammers come out in droves. So, if you want to make sure you don’t get ripped off, keep reading.

Secure Computing Corporation, a leading enterprise gateway security company, warned in a press release that socially engineered email spam, indicating that the recipient has won a new iPhone, is directing users to a malware hosting website. If the user clicks on a link, the users’ browser will attempt to connect to a Web site and install malicious software designed to take control of the victim’s computer. The criminals behind this scam are using sophisticated techniques. The Web site is loaded with more than 10 Active X vulnerabilities, each targeting a potential browser vulnerability. In addition, the website is tracking visitors on the site and then redirecting repeat visitors to a different, clean Web site in efforts to thwart security researchers as well as using XOR encryption to obfuscate the attack.
Paul Henry, vice president of technology evangelism for Secure Computing, believes that although this is the first iPhone-related phishing scam, it certainly will not be the last. “Because of the popularity of the iPhone brand, this is the first in what’s bound to be a series of scams involving the iPhone,” he said.

Sunbelt Software Distribution Inc. spotted a new Trojan horse that redirects unwitting iPhone shoppers to a bogus Web site when they surf to iphone.com, a legitimate address that normally takes users to Apple’s own iPhone site.
The Trojan horse, which has not yet been named by antivirus vendors, produces a pop-up when users on infected Windows PCs head to either Yahoo.com or Google.com. The pop-ups tout iPhone.com as “the only place to buy iPhone,” and use the Apple logo and the actual price ($499) of the 4GB model to add weight to the offer.”On this infected system, you get directed to a custom ‘iphone.com’ which actually is a fake site,” said Alex Eckelberry, Sunbelt’s CEO, in a blog entry.
The Trojan horse pulls content from the infected machine and injects code into Microsoft Corp.’s Internet Explorer browser to build what looks like an Apple-owned site. As the duped buyer makes his way through the purchase screens, he comes to the end and he is told to send the money via Western Union or MoneyGram. And I expect that you’ll never get your iPhone or your money back.