NoSEBrEaK - Attacking Honeynets

TL;DR

This paper reveals a method by which attackers can fully control a host within a honeynet without triggering significant detection or logging, challenging the assumption that honeynets are inherently hard to compromise.

Contribution

It introduces a novel attack technique that allows complete control over honeynet hosts without detection, highlighting vulnerabilities in honeynet security assumptions.

Findings

Attack can fully control honeynet hosts

Honeynets can be compromised without detection

Challenges existing security assumptions

Abstract

It is usually assumed that Honeynets are hard to detect and that attempts to detect or disable them can be unconditionally monitored. We scrutinize this assumption and demonstrate a method how a host in a honeynet can be completely controlled by an attacker without any substantial logging taking place.