A new voice phishing scam is going after iPhone users in a clever new way: by making calls seem like they are coming directly from Apple Support.
Brian Krebs reported today that a user, Jody Westby, got a call from Apple Support asking for her to call back. The contact information that came along with the number appeared to be Apple Inc.’s in the identity screen for the call. When she called the 866 number, however, something was clearly amiss. 
KrebsOnSecurity called the number that the scam message asked Westby to contact (866-277-7794).
An automated system answered and said I’d reached Apple Support, and that my expected wait time was about one minute and 30 seconds. About a minute later, a man with an Indian accent answered and inquired as to the reason for my call.
Playing the part of someone who had received the scam call, I told him I’d been alerted about a breach at Apple and that I needed to call this number. After asking me to hold for a brief moment, our call was disconnected.
No doubt this is just another scheme to separate the unwary from their personal and financial details, and to extract some kind of payment (for supposed tech support services or some such). But it is remarkable that Apple’s own devices (or AT&T, which sold her the phone) can’t tell the difference between a call from Apple and someone trying to spoof Apple.
The exploit is unique because it allows callers to masquerade as other callers essentially by polluting search results with junk information that makes one number look like the contact number for a real company. The number Westby was told to call is a known phishing source. Remember: If anyone calls you claiming that your computer is broken they are most probably lying. After all, support people will never be proactive when it comes to problems with your computers, only reactive (if that).
John Biggs
Source link
