Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Port 2968 big rise - related to Symantec AV? InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Port 2968 big rise - related to Symantec AV?

Published: 2007-01-10
Last Updated: 2007-01-11 04:36:52 UTC
by Jason Lam (Version: 1)
1 comment(s)
Port 2968 is getting quite a jump recently. Take a look at the graph below.

Port 2968 Graph

We suspect the jump is due to the recent Symantec AV 10.1 exploitation. The previous exploits generally hit on port 2967 since that's the port that Symantec AV listens on (for Windows). According to documentation from Symantec, port 2968 is only used for AV running on Netware servers. We are not sure at this point whether the attackers are targeting Netware server since other hosts have all been exploited already or if Symantec AV listens on port 2968 as a backup port. If you have any info on the port 2968 traffic, please let us know.
Keywords:
1 comment(s)
Diary Archives