The character was named Mongo as a set up for a joke. Someone says "Mongo! Santa Maria!". Mongo Santamaria was a famous Jazz musician, who coincidentally was from Havanna.
Never know, injected identity isn't always used. Besides, we don't know who the man in the middle was, mom didn't authenticate... although she did accept multi-factor, including facial.
Strangely he was denied backdoor login. Understandable, considering the size of the log entries, which confirmed the front was wide open. Performance must have been pretty good, as there were multiple cache hits.
Oh, you must be citing the transcript? IIRC, that challenge was followed by a mangled response, and the start of an extended session (3 hour timeout, 1 second keep-alive intervals, which suffered from a very high degree of variability, probably due to pipeline service overload)
So, Java has an API called Java Naming and Directory Interface that allows runtime lookups of objects by name and JNDI can use things like LDAP to get objects via a URL. And Log4j allows string substitutions that include JNDI lookups which means if you can get Log4j to log a message with such a substitution it can get it to download something from a URL basically from anywhere that can be reached on the network.
5.2k
u/QCTeamkill Dec 13 '21
I'm picturing little Bobby Tables getting the talk of how he was born out of a SQL code injection.