Researchers ponder cause of Trend Micro port scanning

By on

Security experts believe increased scanning today of a TCP port related to Trend Micro's anti-virus solution is not the result of two product vulnerabilities announced this week but instead an older flaw that already has been patched.

Handlers with the SANS Internet Storm Center reported today that they were witnessing increased activity on port 5168, likely the work of overseas hackers searching for Windows servers vulnerable to a bug announced February in Trend's ServerProtect anti-virus product.

This confused some researchers, who initially assumed the scans were related to two other buffer overflow  vulnerabilities in ServerProtect, revealed Wednesday by iDefense. Trend has issued patches for those flaws.

"Indications are that the ServerProtect exploit is against an older vulnerability from earlier this year," SANS handler Kyle Haugsness wrote today on the organisation’s blog.

"But this does indeed appear to be a new exploit, thus machines are being actively compromised if they haven’t been patched."

Jose Nazario, senior security researcher at Arbor Networks, wrote on his blog today that the scans are mostly being conducted by Chinese-based botnets.

Customers have not reported any problems, Trend spokesman Mike Haro told

"It's speculative whether an increase 5168 traffic is indicative that these hackers are successful in compromising networks," he said. "We've received no reports from ServerProtect customers of them having problems, of them having been compromised."
Got a news tip for our journalists? Share it with us anonymously here.

Most Read Articles

Log In

  |  Forgot your password?