About Data Control

[Martim Carbone <martim.carbone () ic unicamp br>]

Hi,

I am currently working on the Data Control part of my Honeynet, and have 
already configured Snort-inline to run with the rc.firewall script 
provided by the Honeynet Project. This configuration could prevent exploit 
attacks, scans and some DoS attacks. However, there is still one type of 
"attack" this setup does not prevent.

Suppose a random attacker breaks into a random machine A on the 
Internet, installs a backdoor and then breaks into OUR honeypot.
He could effectively use our honeypot as a bounce station and 
anonymize his connection to his backdoor on host A. And as far as I know, 
neither snort-inline nor the connection-limiting scheme could prevent 
him from doing it. Needless to say, this  could get the honeynet's administrators 
into serious trouble if  A's administrators find out where the attacker is 
connecting from.

Any ideas on how to prevent this?

Thanks,

-- Martim