CMU Student Pleads Guilty to Designing Malware, Selling it on Hacker Forum

PITTSBURGH – A Carnegie Mellon University student pleaded guilty in federal court to a charge of violating federal laws, United States Attorney David J. Hickton announced today.

Morgan C. Culbertson, 20, of Pittsburgh, Pa., pleaded guilty to one count before United States District Judge Maurice B. Cohill.

According to information presented to the Court, from on or about January 2013 to on or about August 20, 2014, Culbertson participated in a scheme to create and sell malware that could be used to spy on and steal personal information from a Google Android cell phone without the owner’s knowledge. Culbertson crafted a piece of malware ultimately named “Dendroid” which, through the use of a binder, could hide itself within a Google App and then download onto a Google Android phone when the user of that phone downloaded the Google App from a place such as the Google Play Store. Dendroid was designed to avoid detection by anti-virus scanners and Google Play security features and did not affect the functionality of the Google App that it was bound to. Once the malware was downloaded onto a Google Android phone, the malware would connect to a command-and-control server controlled by Culbertson. Dendroid was repeatedly advertised for sale on Darkode with explicit advertisements detailing the malware’s intended capabilities, which included commanding the phone remotely to take photos, intercepting text messages, stealing files, spying on internet browsing history and recording phone calls. In connection with the guilty plea, the court was advised that Culbertson intentionally caused damage without authorization to 10 or more computers.

Judge Cohill scheduled sentencing for Dec. 2, 2015 at 11 a.m. The law provides for a total sentence of 10 years in prison, a fine of $250,000, or both. Under the Federal Sentencing Guidelines, the actual sentence imposed is based upon the seriousness of the offense and the prior criminal history, if any, of the defendant.

Assistant United States Attorney James T. Kitchen is prosecuting this case on behalf of the government.

The Federal Bureau of Investigation conducted the investigation that led to the prosecution of Morgan C. Culbertson.