Patch/Configuration Management, Vulnerability Management

Researchers ponder cause of Trend Micro port scanning


Handlers with the SANS Internet Storm Center reported today that they were witnessing increased activity on port 5168, likely the work of overseas hackers searching for Windows servers vulnerable to a bug announced February in Trend Micro's ServerProtect anti-virus product.

This confused some researchers, who initially assumed the scans were related to two other buffer overflow vulnerabilities in ServerProtect, revealed Wednesday by iDefense. Trend Micro has issued patches for those flaws.

"Indications are that the ServerProtect exploit is against an older vulnerability from earlier this year," SANS handler Kyle Haugsness wrote today on the organization’s blog. "But this does indeed appear to be a new exploit, thus machines are being actively compromised if they haven’t been patched."

Jose Nazario, senior security researcher at Arbor Networks, wrote on his blog today that the scans are mostly being conducted by Chinese-based botnets.

Customers have not reported any problems, Trend Micro spokesman Mike Haro told

"It's speculative whether an increase in 5168 traffic is indicative that these hackers are successful in compromising networks," he said. "We've received no reports from ServerProtect customers of them having problems, of them having been compromised."


Click here to email reporter Dan Kaplan.


Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.