Morgan C. Culbertson, a student from Carnegie Mellon University on Tuesday admitted in federal court to designing and attempting to promote malware that allowed users to take control of other people’s Android smartphones/tablets.
“I’m sorry to the people to whom my software may have compromised their privacy,” Mr. Culbertson stated in pleading guilty to conspiracy to damage protected computer systems.
He informed U.S. District Judge Maurice Cohill Jr. that he was pleading guilty because “I committed the crime” and promised that in the future he would use his expertise to protect computer users.
Assistant U.S. Attorney James Kitchen mentioned that in 2013 Mr. Culbertson, who called himself “Android” online, conspired with another man, “Mike” from the Netherlands, to design a product known as Dendroid and sell it on Darkode, an underground web-based market for criminals and hackers.
Mr. Culbertson, 20, of Churchill, faces up to 10 years in jail when Judge Cohill sentences him in December, though he’s unlikely to get anywhere close to the maximum. He had no comment following the hearing, nor did his lawyer, Emily McNally, or his family.
Dendroid infected victims’ android systems, permitting a customer who had purchased the malware to spy on texts, pilfer files, take images, view browser history & record conversations, all with out the owners’ consent or knowledge.
Mr. Culbertson later bought out Mike’s share of the partnership and began working with another man identified as “Elzig,” Mr. Kitchen stated, in an attempt to market Dendroid on Darkode.
Mr. Culbertson advertised the malware on Darkode for $300, saying he had spent “1.3 years” designing it, and in addition tried to auction the source code that might allow consumers to create their very own version of Dendroid.
Ms. McNally said he didn’t get any offers on his auction attempt.
Following the plea, Judge Cohill allowed Mr. Culbertson to stay free on a $10,000 bond. An engineering student who has completed his sophomore year in the College of Engineering, he told the judge he has taken a leave of absence from the CMU.
CMU spokesman Ken Walters stated that the university had no comment on the matter. Asked if the university had a policy against permitting a pupil to remain enrolled after being convicted of a felony, Mr. Walters said he didn’t know and he has forwarded the query to the administrators.
The Carnegie Mellon Code of Conduct, which is available on the university’s web site, states that college students “are expected to satisfy the highest standards of personal, ethical and moral conduct possible. … Students who can’t meet them should voluntarily withdraw from the university.”
A graduate of Winchester Thurston, a private school in Shadyside, Mr. Culbertson was described by those that know him as an clever, respectful and level-headed student who worked hard and excelled on the tennis team. He was said to have many friends and his parents had been very involved in his life, never missing one of his tennis matches.
Mr. Culbertson was among some 70 individuals targeted in an international investigation based in Pittsburgh that targeted Darkode, which has since been shut down by the FBI. Of those, seven are being prosecuted in Pittsburgh, including Mr. Culbertson.
Three others involved with Darkode have entered guilty pleas in a spam scheme unrelated to Mr. Culbertson’s crime.
Dewayne Watts, 28, and Naveed Ahmed, 27, both of Florida, and Phillip Fleitz, 31, of Indianapolis, admitted to their roles in maintaining a spam botnet that used servers in China to infect routers in other nations and send millions of e-mail messages designed to defeat spam filters of cellphone providers.
[…] Source: Technology News […]