Decoding Galah, an LLM Powered Web Honeypot

Decoding Galah, an LLM Powered Web Honeypot

Speakers: Adel Karimi

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=XGsm4Qcc_Ag

Overview

Adel Karimi's talk at DEF CON 32 introduced Galah, an innovative Large Language Model (LLM)-powered web honeypot designed to dynamically generate realistic HTTP responses. Named after an Australian parrot known for being both smart and dumb—a characteristic Karimi believes mirrors the honeypot's behavior—Galah represents a significant leap from traditional static honeypots. This research focuses on "research honeypots" exposed to the internet to collect intelligence on wide-ranging scan attempts, rather than internal network decoys.

The core motivation behind Galah is to address the inherent limitations of conventional web honeypots, which often struggle with scalability, manual maintenance, and dynamic adaptability to emerging threats. By leveraging LLMs, Galah aims to provide more convincing and engaging interactions for attackers, thereby improving the quality of captured threat intelligence. Karimi's work highlights the potential of LLMs not only to enhance defensive security tools but also to serve as a platform for evaluating the capabilities and limitations of AI in various security contexts.

This project is particularly relevant in an era where new vulnerabilities, especially zero-days, are exploited rapidly in the wild. Traditional honeypots often lag in emulating newly discovered vulnerable services, rendering them ineffective during the critical early exploitation window. Galah's ability to respond on-the-fly to unknown or recently disclosed attack vectors offers a proactive approach to threat intelligence gathering, providing defenders with invaluable insights into active campaigns targeting specific weaknesses.

Background

▶ Watch: Introduction to Galah, an LLM-powered web honeypot (0:00)

The landscape of web honeypots has traditionally been categorized into two main types: low-interaction and high-interaction. High-interaction honeypots involve deploying actual, vulnerable web applications or services, offering a deep level of engagement for attackers. While these provide rich data, they are notoriously difficult to scale and maintain. Managing hundreds or thousands of real web applications, ensuring their security, and isolating them from production environments presents significant operational challenges.

Consequently, low-interaction honeypots have become more prevalent. These systems simulate specific vulnerabilities or applications without running the full software stack. They are easier to deploy at scale and manage, making them suitable for widespread internet exposure to capture broad scanning activity. However, low-interaction honeypots suffer from a critical drawback: their static nature. They typically rely on predefined responses or hardcoded emulations of known services. This makes them susceptible to fingerprinting, where sophisticated attackers can easily identify them as honeypots based on their predictable and often incomplete responses. Open-source honeypots, in particular, are prone to this, as their signatures are widely known.

The problem is exacerbated when new vulnerabilities, especially zero-day exploits, emerge. A prime example cited by Karimi is the Palo Alto Global Protect zero-day exploit. When such a vulnerability is disclosed, attackers quickly scan the internet for vulnerable instances. For a traditional honeypot, the process of emulating this new vulnerability is a manual, labor-intensive task. Security researchers would need to understand the vulnerability, replicate the affected service's interface and behavior, and then deploy the updated honeypot. By the time this is accomplished, often days or weeks after disclosure, the initial wave of exploitation may have already occurred, and the most aggressive attackers would have moved on, having already identified and targeted real systems. Furthermore, attackers often prioritize older, established instances of vulnerable software, making newly deployed, static honeypots less convincing. This creates a significant gap in real-time threat intelligence.

Key Findings

▶ Watch: The challenge of emulating zero-day exploits (1:00)

Galah’s primary contribution lies in its demonstration of LLM-powered dynamic response generation for web honeypots. The project showcases how large language models can overcome the static limitations of traditional low-interaction honeypots, offering several key findings:

1. Dynamic and Realistic Response Generation: Galah can generate plausible HTTP responses, including intricate HTML structures with embedded CSS and JavaScript, in real-time. This capability was notably demonstrated in its response to an attempt targeting the Palo Alto Global Protect vulnerability. Within "less than a second," Galah produced a web interface that, while not a "perfect replica," was sufficiently detailed for a browser to render, including stylesheets and scripts. This dynamic generation significantly enhances the realism of the honeypot, making it harder for attackers to distinguish from legitimate services.

1. Early Zero-Day Exploit Detection Potential: The honeypot successfully captured an attempt against the Global Protect vulnerability just "a few days after the release of the vulnerability." This highlights Galah's potential to provide critical early warnings and collect intelligence on zero-day exploitation attempts, a period when traditional honeypots are often still being manually updated or deployed. Its ability to adapt on-the-fly to newly emerging threats is a game-changer for proactive threat intelligence.

1. Improved Attacker Engagement: By offering more realistic and varied responses, Galah aims to increase the time and effort attackers invest in interacting with the honeypot. This extended engagement allows for the collection of richer and more comprehensive data on attacker methodologies, tools, and objectives. The concept is to "waste attackers' time" and even make them "suffer from the hallucination" that they are interacting with a real system, thereby diverting resources and attention away from actual targets.

1. Platform for LLM Evaluation in Security: Beyond its immediate application as a honeypot, Galah serves as a practical platform for evaluating the performance and limitations of LLMs in security contexts. Karimi explicitly states this as a main purpose, suggesting that lessons learned from Galah's behavior—including instances of "hallucination" in its responses—can inform the development and deployment of LLMs for other security use cases, such as vulnerability analysis, incident response, or even offensive security.

These findings collectively demonstrate that LLMs can significantly enhance the sophistication and effectiveness of honeypots, moving them from static traps to dynamic, adaptive intelligence-gathering systems capable of responding to the ever-evolving threat landscape.

Technical Deep Dive

▶ Watch: Live demo: Galah's dynamic response to an exploit (2:00)

The core innovation of Galah lies in its utilization of a Large Language Model (LLM) to generate HTTP responses dynamically. Unlike traditional honeypots that rely on static templates or pre-programmed logic, Galah leverages the generative capabilities of an LLM to craft responses tailored to incoming requests.

The fundamental principle involves feeding the LLM with information about the incoming HTTP request—such as the requested URL path, HTTP headers, and potentially even the body—along with a specific prompt. This prompt would instruct the LLM to act as a particular type of web service (e.g., a firewall login page, a web server, or a specific application like Palo Alto Global Protect). The LLM then uses its vast training data to predict and generate an appropriate, realistic-looking HTTP response, often in HTML format, complete with styling (CSS) and interactive elements (JavaScript).

For instance, when Galah detected an attempt to exploit the Global Protect vulnerability, the system likely extracted key identifiers from the attacker's request (e.g., specific paths, user-agent strings, or payload patterns). This information was then used to construct a prompt for the LLM, guiding it to generate an HTML page resembling a Global Protect login or error page. The LLM's ability to synthesize various web components—from form fields and branding elements to embedded CSS for layout and JavaScript for basic client-side functionality—is crucial for creating a convincing facade. The fact that the generated response included functional CSS and JS indicates a sophisticated level of output from the LLM, allowing a browser to render a visually coherent page.

The "smart and dumb" analogy for Galah is particularly insightful here. The "smart" aspect is the LLM's capacity to understand context and generate complex, relevant web content on the fly, adapting to diverse and even novel attack patterns. The "dumb" aspect refers to the LLM's inherent tendency to "hallucinate" or generate plausible but factually incorrect or inconsistent information. In the context of a honeypot, these "hallucinations" are not necessarily detrimental; in fact, they can be beneficial. They make the honeypot's behavior less predictable than a deterministic, static system, potentially further confusing attackers and extending their engagement. An attacker might encounter a login page that looks legitimate but behaves slightly off-kilter, prompting them to spend more time probing it.

While the specific LLM model used (e.g., GPT-3, GPT-4, or an open-source alternative) and the exact prompt engineering techniques were not detailed in the provided transcript, the success of Galah points to effective prompt design. This would involve carefully crafted instructions to the LLM to:

1. Emulate a specific service: "Generate an HTML login page for a Palo Alto Global Protect VPN."
2. Include realistic elements: "Ensure it has a corporate logo, username/password fields, and a submit button. Add basic CSS for a modern look and feel."
3. Respond to specific inputs (if applicable): While not explicitly stated, a more advanced Galah could potentially feed subsequent attacker inputs back into the LLM to generate multi-turn interactions, further increasing realism.

The ability to generate responses in "less than a second" is critical for maintaining the illusion of a live service, especially in the context of internet-wide scanning where latency can be a giveaway. This implies efficient integration between the honeypot's request handling and the LLM inference engine, potentially utilizing optimized API calls or local inference capabilities.

Demo / Proof of Concept

▶ Watch: Three main purposes of LLM-based honeypot research (4:40)

The talk provided a clear proof of concept for Galah's capabilities through its response to an attempt targeting the Palo Alto Global Protect vulnerability. This demonstration served as the cornerstone of the presentation, illustrating the honeypot's core functionality.

During the talk, Adel Karimi presented a screenshot or visual representation of how Galah responded to an attacker's request aimed at exploiting the Global Protect zero-day. The key takeaway from this demonstration was the dynamic generation of a web interface that, despite not being an exact, pixel-perfect replica of a genuine Global Protect portal, was remarkably realistic.

The speaker highlighted several crucial aspects of this demonstration:

• On-the-fly Generation: The response was generated by the LLM in "less than a second," showcasing the speed and responsiveness of the system. This rapid generation is essential for capturing fast-moving exploitation attempts against newly disclosed vulnerabilities.
• Rich Web Content: The generated response included not only basic HTML but also CSS for styling and JavaScript for potential client-side functionality or interactive elements. This level of detail is critical for convincing attackers that they are interacting with a fully functional web application, rather than a simplistic, static honeypot.
• Browser Renderability: Karimi explicitly mentioned that a web browser could "actually render it and show you a result like this." This confirms the structural integrity and validity of the LLM-generated HTML, CSS, and JS, making the honeypot's facade highly credible to an attacker's tools and human analysis.

This specific example effectively illustrated how Galah addresses the limitations of traditional honeypots. Instead of waiting for manual updates to emulate a new vulnerability, Galah could, within days of the vulnerability's disclosure, present a convincing, dynamically created response, thereby capturing valuable intelligence from early exploitation attempts. The demonstration underscored the practical utility of integrating LLMs into security tools to create more adaptive and intelligent defensive mechanisms.

Defensive Implications

▶ Watch: Understanding limitations of traditional web honeypots (5:30)

Galah's innovative approach to honeypot technology carries significant defensive implications for organizations and threat intelligence communities. By leveraging LLMs, defenders can enhance their ability to detect, analyze, and respond to emerging threats more effectively.

1. Early Warning for Zero-Day Exploits: The most profound implication is Galah's potential to provide early warning for zero-day exploitation attempts. Traditional honeypots often become relevant only after a vulnerability has been publicly disclosed and a static emulation developed. Galah, by contrast, can dynamically generate responses to requests targeting services it has not been explicitly programmed to emulate. This means that even if a new vulnerability (like the Palo Alto Global Protect example) is unknown to defenders, Galah could potentially respond plausibly to initial scanning or exploitation attempts, thus providing an early indicator of compromise or active campaigns before official patches or signatures are available.

1. Enhanced Threat Intelligence Gathering: The increased realism and dynamic nature of LLM-powered honeypots lead to deeper attacker engagement. Attackers are more likely to spend additional time probing a convincing honeypot, revealing more of their Tactics, Techniques, and Procedures (TTPs), tools, and payloads. This richer interaction translates into more comprehensive threat intelligence, which can be used to:

• Develop more precise detection rules (e.g., YARA rules, SIEM correlation rules).
• Understand attacker motivations and targets.
• Identify new attack vectors or variations of existing exploits.
• Map attacker infrastructure.

1. Wasting Attacker Resources: Karimi explicitly mentioned the goal of "waste attackers' time" and make them "suffer from the hallucination." By presenting highly convincing, yet ultimately fake, targets, LLM honeypots can consume an attacker's valuable time, computational resources, and expertise. Diverting these resources away from legitimate targets can reduce the overall attack surface and provide a form of active defense. The "hallucinations" generated by the LLM can further disorient attackers, making it harder for them to discern real targets from decoys.

1. Scalability and Adaptability: Galah's LLM-driven architecture inherently addresses the scalability and adaptability challenges of traditional honeypots. Instead of manually maintaining hundreds of static emulations, a single LLM-powered honeypot can dynamically adapt to emulate a vast array of services based on incoming requests. This reduces operational overhead and allows defenders to cover a broader range of potential attack targets without a proportional increase in effort.

1. Platform for LLM Security Research: As Karimi noted, Galah also serves as a platform for evaluating LLMs for security use cases. For defenders, this means insights gained from Galah's performance—its strengths in generating realistic content and its weaknesses in terms of hallucinations or inconsistencies—can inform the responsible and effective deployment of AI in other security tools, such as automated vulnerability assessment, anomaly detection, or incident response playbooks.

In summary, Galah offers a paradigm shift for defensive security, enabling more proactive, intelligent, and scalable threat intelligence gathering, ultimately bolstering an organization's resilience against sophisticated and rapidly evolving cyber threats.

Key Takeaways

• LLMs Revolutionize Honeypot Dynamics: Galah demonstrates how Large Language Models can transform traditional static honeypots into dynamic, adaptable systems capable of generating realistic HTTP responses on the fly.
• Early Detection of Zero-Days: The honeypot's ability to respond convincingly to attacks targeting newly disclosed vulnerabilities, such as the Palo Alto Global Protect zero-day, provides critical early warning intelligence.
• Enhanced Attacker Engagement: By generating rich web content including CSS and JavaScript, Galah creates more realistic interactions, increasing attacker engagement and yielding deeper insights into their TTPs.
• Operational Efficiency: LLM-powered honeypots significantly reduce the manual effort and scalability challenges associated with maintaining a diverse portfolio of traditional, static honeypot emulations.
• Strategic Deception: Galah actively "wastes attackers' time" and leverages LLM "hallucinations" to disorient and confuse adversaries, diverting their resources from legitimate targets.
• LLMs as a Security Research Platform: The project serves as a valuable testbed for evaluating the capabilities and limitations of LLMs in security contexts, informing their application in other defensive tools.

About the Speaker(s)

Adel Karimi is a seasoned professional in the field of detection and response, bringing over a decade of experience to his work. He has held significant roles at prominent technology companies, including Google, Salesforce, and currently Niantic. While his professional career is focused on safeguarding these organizations, the Galah project is a personal endeavor, developed in his spare time and unrelated to his day job. Karimi openly admits that he is not an "AI or LLM expert," humbly advising the audience that anything he says about AI or LLMs "could be hallucination," a sentiment that playfully mirrors the "smart and dumb" nature of his honeypot, Galah. His passion for security research, particularly in areas like honeypots, drives his innovative contributions to the cybersecurity community.