Handlers with the SANS Internet Storm Center reported today that they were witnessing increased activity on port 5168, likely the work of overseas hackers searching for Windows servers vulnerable to a bug announced February in Trend's ServerProtect anti-virus product.
This confused some researchers, who initially assumed the scans were related to two other buffer overflow vulnerabilities in ServerProtect, revealed Wednesday by iDefense. Trend has issued patches for those flaws.
"Indications are that the ServerProtect exploit is against an older vulnerability from earlier this year," SANS handler Kyle Haugsness wrote today on the organisation’s blog.
"But this does indeed appear to be a new exploit, thus machines are being actively compromised if they haven’t been patched."
Jose Nazario, senior security researcher at Arbor Networks, wrote on his blog today that the scans are mostly being conducted by Chinese-based botnets.
Customers have not reported any problems, Trend spokesman Mike Haro told SCMagazine.com.
"It's speculative whether an increase 5168 traffic is indicative that these hackers are successful in compromising networks," he said. "We've received no reports from ServerProtect customers of them having problems, of them having been compromised."
Researchers ponder cause of Trend Micro port scanning
By Dan Kaplan on Aug 24, 2007 10:43AM
Security experts believe increased scanning today of a TCP port related to Trend Micro's anti-virus solution is not the result of two product vulnerabilities announced this week but instead an older flaw that already has been patched.
Got a news tip for our journalists? Share it with us anonymously here.