I've been dicking around with my new iPhone 3GS.
Maybe this has been known for sometime, but the information from the DevTeam blog says to look in /tmp. It's much easier to snag them out of:
/Users/[username]/Library/Caches/Cleanup\ At\ Startup/iPhone\ Temporary\ Files.noindex/Firmware/dfu
The iBEC and iBSS files are right there, nothing else.
The "Cleanup at Startup" folder and all subfolders are removed by iTunes when the iPhone is restarting after a Restore.