Researchers ponder cause of Trend Micro port scanning

Handlers with the SANS Internet Storm Center reported today that they were witnessing increased activity on port 5168, likely the work of overseas hackers searching for Windows servers vulnerable to a bug announced February in Trend's ServerProtect anti-virus product.

This confused some researchers, who initially assumed the scans were related to two other buffer overflow  vulnerabilities in ServerProtect, revealed Wednesday by iDefense. Trend has issued patches for those flaws.

"Indications are that the ServerProtect exploit is against an older vulnerability from earlier this year," SANS handler Kyle Haugsness wrote today on the organisation’s blog.

"But this does indeed appear to be a new exploit, thus machines are being actively compromised if they haven’t been patched."

Jose Nazario, senior security researcher at Arbor Networks, wrote on his blog today that the scans are mostly being conducted by Chinese-based botnets.

Customers have not reported any problems, Trend spokesman Mike Haro told SCMagazine.com.

"It's speculative whether an increase 5168 traffic is indicative that these hackers are successful in compromising networks," he said. "We've received no reports from ServerProtect customers of them having problems, of them having been compromised."

causemicroofponderportresearchersscanningsecuritytrend