Port 5901 Scans On The Increase (vnc?)

FYI…

- http://isc.sans.org/diary.html?storyid=3093
Last Updated: 2007-07-03 22:28:54 UTC ~ "…Some outlets have reported on the major increase in port 5901 scanning we're seeing in our (your) logs. This increase is not uncollaborated. Others* are reporting very similar increases. Port 5901 is generally used as the first VNC (Virtual Network Computing) display on Linux machines, and the second one on Windows hosts. There are a number of popular implementations of VNC, of which the most popular are UltraVNC, TightVNC and RealVNC. A number of recent security vulnerabilities have added incentive for attackers to start indexing hosts running this service… It likely indicates attackers may have been successful in compromising a number of hosts using vulnerabilities in this service, increasing their belief in VNC as a viable attack vector. It could also indicate the release of new attack tools…"

* http://asert.arbornetworks.com/2007/07/net…-tcp-port-5405/

(Graphics available at both URL's above.)

FYI…

- http://isc.sans.org/diary.html?storyid=3096
Last Updated: 2007-07-04 12:09:07 UTC ~ "Update
A reader suggested that the increased activity on various ports such as 5900, 1433 and some others may be related to the release of the ya bot source code early June, as it includes scans for those ports. A quick check of the source code confirms the ability and changing the ports seems trivial which may account for the scans to port 5901 mentioned earlier…

http://isc.sans.org/port.html?port=5901

http://isc.sans.org/port.html?port=1433

As you'll be able to see from the graph it eased off a little bit, but still significantly higher than it has been recently. Port 1433 is generally used by MSSQL…"

.