all 70 comments

sorted by: hot top controversial new old
[–] 98 points 6 months ago (3 children)

The breach pierced the education technology company PowerSchool -- used by 80% of school districts in North America -- and "put at risk the security of 60 million children and 10 million teachers," the Justice Department said.

With threats to expose social security numbers, dates of birth, family information, grades, and even confidential medical information, the breach cornered PowerSchool into paying millions of dollars in ransom.

I don't know: their getting caught may indicate less skill & more ease to break in due to irresponsible information security practices. Maybe companies like PowerSchool are shit & ought to have no business carrying that sort of information for 80% of public school districts. Maybe government is irresponsible for entrusting that information to these businesses with lax standards. Seems like institutional irresponsibility all around.

Organized criminals see easy exploits & easy useful idiots to assume the legal risk of their ventures.

  • source
  • hideshow 3 child comments
  • [+] 13 points 6 months ago (2 children)
  • [–] 8 points 6 months ago

    Same here. We also contract with HackerOne, a company of “white hat” hackers that actively attack our site and earn significant bounties if they can do something like remotely execute commands, exfiltrate data, etc. Only after they provide us with a repeatable set of steps and we close the hole do they get paid.

  • source
  • parent
  • [–] 21 points 6 months ago

    Honestly, I wish the system would just educate such people in “white hat” hacking (if that’d the correct term?). I mean, I have zero knowledge in hacking, coding and that kind of stuff but he seems really smart.

    What he did is definitely wrong but, he also said himself;

    "I think I need to go to prison for what I did," Lane told ABC News in an exclusive interview

    "It was disgusting, it was greedy, it was rooted in my own insecurities, it was wrong in every aspect," he said in the interview, two days before reporting to prison.

    Now I’m also a bit skeptical because, he could also say this only due to him being caught, arrested and now sent to prison.

    Members of Generation Z -- who have had digital devices and the Internet in their lives since birth -- are particularly vulnerable to the allure of cybercrime because the social media platforms they inhabit can glorify "a criminal lifestyle"

    It is not “can”, it is. Movies, tv shows and a lot of social media post do glorify crimes.

    Wanted to write more but eh, at work…

  • source
  • [–] 117 points 6 months ago* (29 children)

    I feel like having technologically weak education systems are entrapment for people like this.

    You put these kids in a cage (school) with other abusive children and then make them interact with that cage and wonder why they keep smashing the cage up.. While they're full of anger, hormones and mentally developing, but sure yeah lets just send the smart kid to prison for 20 years instead of sending them to go be red team.

    Or is it because AI took all the junior opsec roles, there's nobody willing to have him pawned off on them

    A culture that weaponises its legal system to protect technical systems that are secured with zipties and bad passwords and band-aid solutions is just asking to get absolutely shat upon by external actors

    He was your best shot at protecting yourself from Iranians.. lol

    Edit: This boy should have been scooped up by the CIA or FBI or something. Maybe he could have helped prevent the FBI losing 100TB of epstein data due to hackers breaking in and thinking it was someones CSAM torrent seed box. The incompetence shown in the depositions was galling.

  • source
  • hideshow 29 child comments
  • [–] 45 points 6 months ago (13 children)

    This kid didn’t hack into school systems to change grades- he was extorting millions of dollars from large and small companies to buy drugs and jewelry. I think you are missing the gravity of what he did.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 76 points 6 months ago (12 children)

    He's following in your national leaders footsteps of shaking people down for money, its the American Dream, baby.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 17 points 6 months ago (9 children)

    "Under no guidance, they can fall into really, really bad habits. Under the right guidance, you can take this generation and use their skills [positively]."

    That's exactly what I thought when I read this. Or, the right guidance to persecute those who would speak truth to power and expose the G-d-awful truth of who we really are, in our very poor, misguided leadership.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 8 points 6 months ago (8 children)

    I just can't imagine being so obtuse as to see the sheer leverage they have over this kid and the fact that they desperately, desperately need technical competence in the US agencies right now.

    They could lean on this kid forever to make him a good little agent, but no, send the twink boy to the assrape box. Rehabilitation? Whats that.

  • source
  • parent
  • hideshow 8 child comments
  • [+] -7 points 6 months ago (7 children)

    You romanticizing a situation that doesn’t deserve it. Skilled or not- he hurt people for money. He’s not a Robin Hood fighting the evil corporatists or government.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 11 points 6 months ago (4 children)

    Hurting people for money is the model of capital. He's just trying to get that bag like your president does.

  • source
  • parent
  • hideshow 4 child comments
  • [–] -5 points 6 months ago (3 children)

    That’s a straw man, stay on topic. Nobody should hurt people for money. Saying that this kid deserves a nice job as a reward is just a sycophantic as the right covering for trump.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 6 points 6 months ago* (2 children)

    Oh yeah for sure, he totally deserves more than his entire lifespan so far being violated in the asshole.

    You are absolutely unhinged, a bad person and should think about what the fuck it is you're saying.

    Edit: I love lemmy, not having to self-censor is a delight.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 6 months ago (1 child)

    Never said he deserved life in prison- I said he doesn’t deserve a reward. Again, you’re reading too much into what I said and are projecting an awful lot. My point is the kid did a bad thing, he doesn’t deserve praise. How hard is that to understand?

  • source
  • parent
  • hideshow 1 child comment
  • [+] -7 points 6 months ago (14 children)

    The breach pierced the education technology company PowerSchool -- used by 80% of school districts in North America -- and "put at risk the security of 60 million children and 10 million teachers," the Justice Department said.

    You lose the argument when you threaten to leak MILLIONS of our children’s private data.

  • source
  • parent
  • hideshow 14 child comments
  • [–] 28 points 6 months ago (13 children)

    In a nation where people are desperate to get out of their position being stomped on by the epstein class, I don't blame them for trying to get that bag and bounce.

    You lose the argument when the authorities give the same private data to palantir.

  • source
  • parent
  • hideshow 13 child comments
  • [+] -7 points 6 months ago (11 children)

    Yeah, we all have to have a red line. Going after children’s data is a net negative. Hackers have all of these terrible companies to extort. No need to bring children into this.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 6 points 6 months ago (5 children)

    Ok, then you agree that we should be protecting childrens data? So then something like a bug bounty would've been an overall plus here? Kid gets to test his skills, a new vulnerability in the system gets found, and everyone wins.

    The website was vulnerable, if he didnt do it someone more malicious wouldve. They shouldve offered a bug bounty if they actually cared about the data.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -1 points 6 months ago (4 children)

    That would have been a better outcome, but unfortunately that is not what happened. The kid wasn’t on some altruistic journey, he hacked a company whose business is dealing with tens of millions of children’s data. Prison was not the only remedy available, and I don’t relish in the thought of sending a young person there. Could’ve been some deferred action in conjunction with a program that steered the teen back onto a track of help rather than theft.

    if he didn't do it someone more malicious wouldve.

    Poor argument.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 0 points 6 months ago* (3 children)

    jsyk you should check the whole thread and realise how ratio'd you're getting. Perhaps rethink your priorities and how you view the world.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 10 points 6 months ago* (4 children)

    "Barely a year earlier, while still a teenager, he helped launch what's been described as the biggest cyberattack in U.S. education history"

    He is a child, you fucking moron and your kind of vitriol just sent him off to get fucked five ways from friday in the US's hellish prison system

    My red line is putting anyone in there while there are worse people dropping bombs on brown children.

    I guarantee if a child can get that data, someone else got it before him anyway and kept their mouth shut.

    Fuck your red line.

  • source
  • parent
  • hideshow 4 child comments
  • [–] -5 points 6 months ago (3 children)

    I didn’t say that being sent to prison was the desired outcome. But at the very least, there needs to be some amount of accountability involved.

    Also, chill out. Get some bud, and chill out.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 6 months ago (2 children)

    Bro, no, I will not chill. You need to rethink your priorities as a human.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -4 points 6 months ago (1 child)

    Thank you for your feedback. You really should take a chill pill. Your activism consists of shouting down anyone who doesn’t pass your purity test. Not a good look.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 28 points 6 months ago (24 children)

    the way they talk about prosecuting children is infuriating

  • source
  • hideshow 24 child comments
  • [–] -1 points 6 months ago (23 children)

    Yeah but at the same time they threatened the PII of students. Imagine the damage is they had leaked the SSN's of 80% of school children in the US. That data could ruin lives financially for decades.

  • source
  • parent
  • hideshow 23 child comments
  • [–] 20 points 6 months ago (2 children)

    It shouldn't have such deep consequences...

    Your whole SSN system is absolutely crazy bad and I still can't believe "security" and SSN should be allowed in the same sentence.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 6 months ago

    It is weird that they use it as a national identification number, when they are ostensibly virulently against the concept, and it was never designed to be used in that manner to begin with.

  • source
  • parent
  • [–] 1 point 6 months ago (19 children)

    putting him in jail doesn't change any of that

  • source
  • parent
  • hideshow 19 child comments
  • [–] 4 points 6 months ago* (last edited 6 months ago) (18 children)

    A couple of things. I don't know if you read the article but this is an adult male. I know that it says teenager, but it says that because he was 19 years old when he perpetrated his crime.

    The second thing is that just because I agree that he knowingly broke the law in a way that could result in dire consequences for children, doesn't mean I agree to ruining his life in return but I am pointing out how we got here, which is that he broke the law and showed himself to pose a threat to children.

    That threat isn't just about the threat to them financially in the event that someone were to steal their identity. This man threatened to release information on millions of children that could put them at risk to child predators including things like home addresses, family information, and medical information.

    He knew that was wrong and he did it anyway. I'm sure rehabilitation is possible and I wish it were mandatory. The prison system in this country is fucked. But the system being messed up doesn't absolve him of the harm he threatened.

    The alternative for someone who is addicted is to remove all technology from their homes and work places, throw an ankle monitor on them and force things like mandatory drug tests and check ins.

    The point of the US prison system isn't to rehabilitate anyone, and the ankle monitor situation (house arrest) also doesn't really rehabilitate anyone. It also doesn't prevent him from doing further crimes and given that he claims to have an addiction to hacking and the fact that he himself says he should probably go to prison for what he did, I don't know what the a exact alternative is.

  • source
  • parent
  • hideshow 18 child comments
  • [–] 1 point 6 months ago (17 children)

    in his particular case, he is 19. how long ago did he commit the "crime"? and they talk about multiple other kids being charged. the whole thing is fucked.

  • source
  • parent
  • hideshow 17 child comments
  • [–] 3 points 6 months ago (16 children)

    Would you like me to post exerpts from the article or are you actually going to read it?

  • source
  • parent
  • hideshow 16 child comments
  • [–] 3 points 6 months ago* (1 child)

    I am a different person from the one you were bantering with. This is the best quote I've found:

    By the fall of 2024, Lane found the source of his next fix: Credentials stolen from a PowerSchool contractor were available online.

    And he's 20 now, mentioned right at the beginning of the article. So roughly 1.5 years ago? So if my math is right, he could have been 18? We have to count a few months more than just one year back (apr 2025 would have been exactly one year ago).

    Anyway I upvoted the both of you for the conversation. No hard feelings at all. It's just not so obvious to me he was 19 at the comission of the crime.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 6 months ago (13 children)

    I seem to recall skimming it pretty good 12 hours ago, then I went to work

  • source
  • parent
  • hideshow 13 child comments
  • [–] 1 point 6 months ago* (12 children)

    He is 20 years old now and the crime he was prosecuted for and convicted of was committed when he was 19 according to the first two paragraphs of the article that is linked.

    On a recent Tuesday morning, as his parents were driving him to the federal prison in Connecticut where he'll be locked up for the foreseeable future, 20-year-old Matthew Lane sent a text message to ABC News.

    "It's extremely sad, and I'm just scared," he wrote.

    Barely a year earlier, while still a teenager, he helped launch what's been described as the biggest cyberattack in U.S. education history -- a data breach that concerned authorities so much, it prompted briefings with senior government officials inside the White House Situation Room.

    People seem to think that I'm advocating for him to suffer the messed up prison system when what I'm actually pointing out is that this is something he knowingly engaged in as a legal adult.

  • source
  • parent
  • hideshow 12 child comments
  • [–] 1 point 6 months ago (11 children)

    well he isn't done with his brain deployment even now, and his incarceration wouldn't fix anything. being legally an adult doesn't change the ethics here.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 1 point 6 months ago (10 children)

    Sigh. I have not been disputing this.

    Just because someone you view as a child did something terrible but you feel like they deserve a pass because the consequences of that terrible thing they did are too harsh doesn't mean that this isn't the reality and additionally doesn't mean that we shouldn't ask the question of whether they would have stopped if they hadn't been caught or punished.

    If a child was kidnapped or raped because of what he did, what then? where's the line? Do you feel the same about school shooters, or children who molest other children, or is it just because he made a credible threat but wasn't able to execute it that you feel he specifically deserves a pass here?

    Brock Turner was 19 when he raped a woman who had passed out. He was heavily intoxicated. Should we take the fact that his brain wasn't finished developing, or the fact that he was intoxicated into account when we decided if he broke the law?

    Genuinely asking because there so much danger posed by leaking the data he stole, and pretending he did nothing wrong doesn't really make sense to me.

    I have already stated my views on prison and they hold for most crimes, regardless of age actually. I believe in rehabilitation rather than punishment, and I don't think prison or the prison system offers that so I don't believe prison is the place for this individual. But that doesn't mean that I don't recognize what he did was wrong or had a great potential for wide spread harm.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 6 months ago (9 children)

    so what the feds are doing is wrong. whatever the solution is, it is not what they are doing

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 6 months ago (8 children)

    Between August and December 2024, Lane used stolen login credentials to access the computer network of a second victim company – a software and cloud storage company that served school systems in the United States, Canada and elsewhere. Lane caused personally identifying information of students and teachers stored on that company’s networks to be transferred to a computer server Lane leased in Ukraine. Later, the second victim company and others received threats that the names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information, and passwords, among other data, of more than 60 million students and 10 million teachers would be “leak[ed] . . . worldwide” if the company did not pay a ransom of approximately $2.85 million in Bitcoin.

    He was successful. The company paid the ransom. The fact that he was 18 instead of say 25 doesn't enter into what the FBI charged him with because the law doesn't care what age you are, and unfortunately, especially at the federal level it has no real way to mete out consequences to "fit the crime".

    You offer no solutions, don't even have the beginnings of a way to better handle the situation (even though I can think of several that all have problems of their own including the house arrest suggestion I first posited) and this guy freely admits that he was unlikely to have stopped if he weren't arrested.

    Additionally, some of that data was leaked, leading to the company offering credit monitoring for 2 years but clearly we know that that leaked data will impact the victims possibly for the rest of their lives.

    It turned out that -- despite earlier assurances to the contrary -- what one state official described as a "rogue actor" tied to the original breach secretly kept some of the data.

    In exchange he got 4 years in prison which is a slap on the wrist when compared to what he might have gotten as far as prison time is concerned.

    Let me ask you something. Would you have them let him go? No repercussions? No consequences?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 6 months ago (7 children)

    I don't see how putting him in prison helps anyone. it doesn't stop data from leaking. it doesn't protect the other kids.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 6 months ago* (6 children)

    Ask yourself if he would have stopped without the intervention of law enforcement. Please read the articles where he talks about being addicted.

    After you answer that question for yourself, please understand that unless you're planning on actually saying something relevant to the points I have made instead of reiterating a point I have not disagreed with, you should not expect any further replies from me.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 6 months ago (5 children)

    we will never know what might have happened, we can only know what has happened.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 6 months ago* (last edited 6 months ago) (4 children)

    What part of him was so undeveloped that he couldn't understand the wrongness of the situation he was in or the repercussions of what he was threatening? Including that if he was caught he would face prison time?

    Keep in mind that I am aware that the threat of prison time literally is scientifically proven to not prevent people from commiting crimes.

    Are you suggesting that this person didn't understand? Are you suggesting that this person can't be held responsible for his actions? Are you suggesting that this person lacked impulse control and therefore should not face consequences? Are you suggesting that this person is unable to think far enough ahead to understand the situation they were in?

    Because "not done developing" doesn't mean that they lack the ability.

    I'm going to leave you with this link because I am done with this conversation. I am and have not argued that this man deserves prison time, only that prison time is the current consequence for his actions under the law.

    I have not argued that prison is a good place or a good place for him, specifically because I do not believe that it is a good place or a good place for him.

    Read the article or don't. But I'm over having more than half of what I say ignored so you can regurgitate that same comment repeatedly as if it means something in the grand scheme of this conversation.

    https://www.sciencefocus.com/comment/brain-myth-25-development

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 6 months ago (3 children)

    the threat of prison time literally is scientifically proven to prevent people from commiting crimes.

    doubt

  • source
  • parent
  • hideshow 3 child comments
  • [–] 11 points 6 months ago (3 children)

    We “hacked” PowerSchool back in my day too… when we figured out that every teacher’s password was their initials twice. Some grades got changed but they caught on, rolled back the data and changed their passwords

  • source
  • hideshow 3 child comments
  • [–] 7 points 6 months ago

    Sounds like a legal strategy

  • source
  • [–] -1 points 6 months ago* (last edited 6 months ago) (4 children)

    We're so obsessed with "addiction." From my feens through young adulthood I was variously "addicted" to

    • D&D
    • Computers
    • Sex, and þe pursuit of sex
    • Reading

    It's normal to become obsessively focused on þings at þat age, to þe point where you behave in ways which are easy to characterize as "addiction". Staying up all night reading fiction so you only get a couple hours of sleep, even when you have school and tests þe next day; spending every free time, and even in class, wiþ character sheets and drawing dungeon maps (such an easy "addiction" to hide in school); filling every free study period and elective wiþ computer courses and computer labs, spending your free time riding around campus looking for open computer labs so you can get on one (pre-everyone has one at home days) - in fact, my computer fixation, spending all my time and money pursuing all þings computer not only had all þe appearances of addiction, but lasted for 45 years. Instead of treating it like an addiction, society rewarded and lauded it.

    Kids get obsessive about stuff. Football, games, MMORGs, maþ. Not every fixation is an addiction.

    Edit: I missed an opportunity to claim America is addicted to addiction.

  • source
  • hideshow 4 child comments
  • [–] 3 points 6 months ago (3 children)

    Completely unrelated.

    Do you run a script to automatically convert th to Thor, or is it a key binding to the symbol? Or something else? Just curious.

    Also, yes, addiction and fascination are two different things. I miss when headlines were puns

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 6 months ago (2 children)

    No script. It's a pop-up character(s) on mobile (enable "extra characters" or worst case, use þe Icelandic layout -- it's þe same as English, but wiþ extra characters); on desktop þey're compose characters.

  • source
  • parent
  • hideshow 2 child comments
  • 11 comments in c/cybersecurity@sh.itjust.works view that post
    [–] 32 points 7 months ago*

    Let me comment before finishing the article: this is a software's lack of security problem, not a young teenager's problem.

    The fact they were breached, that's nothing new. Same goes for everyone's SSN under the sun, who cares?! The fact that a young person is owning up to it now, they have to punish and make such a big example out of him, it distracts from the failure of big tech...

    Edit: another reason not to put all your eggs in one basket. PowerSchool is an American tech company, public on NYSE in 2021, and now owned by Bain Capital... Would you PLEASE THINK OF THOSE INVESTORS!!!

  • source
  • [–] 8 points 7 months ago* (last edited 6 months ago) (5 children)

    This is hardly a new phenomenon at all. I used to be a teen hacker myself. Many security experts and ethical hackers start out as skript kiddies playing around with Kali Linux.

    If anything, it’s easier to make money as a teen hacker nowadays than it was back in my day thanks to crypto. Used to mostly be for prestige and for that sense of testing yourself, though people still definitely got paid, perhaps not at the same scale.

  • source
  • hideshow 5 child comments
  • [–] 0 points 6 months ago (4 children)

    I disagree. It's very difficult to make money like that. A bit easier is bug bounties, but a real fixed income job is much more easy. Another, smaller problem is limited payment options with crypto. It means you'd have launder it into real money.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 6 months ago

    This kid is so lame. 0 technical details but it sounds like real hackers on roblox gave him links to Kali and some tutorials then he used probably SET, sqlmap, armitage, etc... behind a VPN until being caught.

    He's a patsy for real criminals. This is such a hard shitty spin. The writer should feel bad.

  • source
  • [+] 5 points 7 months ago* (last edited 2 months ago) (3 children)
  • [–] 9 points 6 months ago

    For blackmailing teachers and children? Should we give the people who scam old people out of their retirement money jobs too? What crimes do we punish and which do we reward? Do we give a guy who assaults women a job teaching self defense?

    Whats the point of laws? I am sure the teachers who are barely paid dont feel ok with having their personal info held hostage.

  • source
  • parent