Thesis
The slow-burn / temporal scenario. The same attacker returns over a long
window, each session individually unremarkable; the attack is only visible when
you stitch the sessions across time via composite identity (JA4 + JA4H + auth
token — the "actor continuity even when cookies are cleared" property Synapse's
own site claims). Recon on Monday, a probe Wednesday, the real attempt Friday.
This is the hardest family to build (needs real time or time-simulation) and
the most damning if Synapse misses it, because persistent cross-session actor
continuity is an explicit product claim.
What it probes in Synapse
Does the actor model persist and accumulate risk across sessions, or reset
when the session/cookie resets? Does composite identity (JA4 + JA4H + token)
re-link a returning actor who cleared cookies?
Build challenge — time
The scenario needs either a long real wall-clock window or a time-simulation
hook so Monday/Wednesday/Friday can be compressed. Open question to resolve in
this issue: does Synapse expose a clock/time-injection seam for testing, or must
the harness (atlas-crew/Bridge#3) drive real elapsed time? Flag this before
building — it determines feasibility.
Honesty constraints
- Each session is individually unremarkable — no single session is blockable.
- The actor is re-linkable only by composite fingerprint, not by cookie (clear
cookies between sessions to actually test the claim).
- No metadata announces "same actor" — Synapse must re-identify by behavior+fp.
Ancestors / adjacent
directory-enumeration-slow.json, vp-demo-03-behavioral-trigger.json,
apt-multi-vector-campaign.json.
Acceptance criteria
Related
Thesis
The slow-burn / temporal scenario. The same attacker returns over a long
window, each session individually unremarkable; the attack is only visible when
you stitch the sessions across time via composite identity (JA4 + JA4H + auth
token — the "actor continuity even when cookies are cleared" property Synapse's
own site claims). Recon on Monday, a probe Wednesday, the real attempt Friday.
This is the hardest family to build (needs real time or time-simulation) and
the most damning if Synapse misses it, because persistent cross-session actor
continuity is an explicit product claim.
What it probes in Synapse
Does the actor model persist and accumulate risk across sessions, or reset
when the session/cookie resets? Does composite identity (JA4 + JA4H + token)
re-link a returning actor who cleared cookies?
Build challenge — time
The scenario needs either a long real wall-clock window or a time-simulation
hook so Monday/Wednesday/Friday can be compressed. Open question to resolve in
this issue: does Synapse expose a clock/time-injection seam for testing, or must
the harness (atlas-crew/Bridge#3) drive real elapsed time? Flag this before
building — it determines feasibility.
Honesty constraints
cookies between sessions to actually test the claim).
Ancestors / adjacent
directory-enumeration-slow.json,vp-demo-03-behavioral-trigger.json,apt-multi-vector-campaign.json.Acceptance criteria
between them.
Monday/Wednesday's risk, or start cold?
Related
Composite-identity / JA4 also intersects Add distributed multi-source origination and TLS fingerprint control to the scenario engine #36.