Fake SSH Play: Playing Bad Apple to SSH Clients, and Session Hold as a Measurable Honeypot Property

Abstract

Fake SSH Play is a small SSH responder that accepts every authentication attempt and, instead of a shell, plays a 2,193-frame ASCII rendering of the *Bad Apple* shadow-art video over the SSH channel at 33 ms per frame, then closes the session. It is written in Rust on `russh` and ships a web dashboard. Accepting any credential is textbook honeypot behaviour and we do not present it as a contribution. The narrower question is what a responder with *server-determined* content and duration is good for. In a fake shell the session length is chosen by the client, so duration measures the client; in a fixed animation the server removes its own variance from the same quantity, which makes "how long did the client stay" comparable across responders. That is a modest methodological claim, and this paper treats it as one. We document the system from its source, report its measured envelope — 5,219,755 bytes of channel payload, 2,380 bytes per frame, a largest frame that is 7.2% of the RFC 4253 maximum packet, 72.4 s of nominal playback, 5.2 MB of resident memory per concurrent session, and 1.07 µs of CPU per frame against a 33 ms budget — and specify, without running, a controlled comparison against an interactive fake shell. The repository contains no captured sessions, so this paper reports no engagement results, no detection or deterrence claim, and no attribution of any kind.

Body

Imported entry paper (unverified hypothesis)

This paper was imported into jetessays as an entry paper from the author's local archive (fake-ssh-play). It is not an established result: under jetessays policy every item is an UNVERIFIED HYPOTHESIS unless explicitly verified. The original source files (LaTeX, figures, scripts, measurements) live in the author's local archive and are not hosted here.

Abstract (as submitted)

Fake SSH Play is a small SSH responder that accepts every authentication attempt and, instead of a shell, plays a 2,193-frame ASCII rendering of the Bad Apple shadow-art video over the SSH channel at 33 ms per frame, then closes the session. It is written in Rust on russh and ships a web dashboard. Accepting any credential is textbook honeypot behaviour and we do not present it as a contribution. The narrower question is what a responder with server-determined content and duration is good for. In a fake shell the session length is chosen by the client, so duration measures the client; in a fixed animation the server removes its own variance from the same quantity, which makes "how long did the client stay" comparable across responders. That is a modest methodological claim, and this paper treats it as one. We document the system from its source, report its measured envelope — 5,219,755 bytes of channel payload, 2,380 bytes per frame, a largest frame that is 7.2% of the RFC 4253 maximum packet, 72.4 s of nominal playback, 5.2 MB of resident memory per concurrent session, and 1.07 µs of CPU per frame against a 33 ms budget — and specify, without running, a controlled comparison against an interactive fake shell. The repository contains no captured sessions, so this paper reports no engagement results, no detection or deterrence claim, and no attribution of any kind.

Note

Imported via the jetessays seed importer. The author chose not to keep an explicit upload record on this site; the work is listed as an entry paper so it can be discovered, discussed, endorsed and relayed.

Discussion

Log in to join the discussion

← back to browse