Carnegie Mellon University student Morgan C. Culbertson on Tuesday admitted in federal court to designing and trying to sell malware that allowed users to take control of other people’s Android phones.
“I am sorry to the individuals to whom my software may have compromised their privacy,” Mr. Culbertson said in pleading guilty to conspiracy to damage protected computers.
He told U.S. District Judge Maurice Cohill Jr. that he was pleading guilty because “I committed the crime” and promised that in the future he would use his skills to protect computer users.
Mr. Culbertson, 20, of Churchill, faces up to 10 years in prison when Judge Cohill sentences him in December, although he is unlikely to get anywhere near the maximum. He had no comment following the hearing, nor did his lawyer, Emily McNally, or his family.
Assistant U.S. Attorney James Kitchen said that in 2013 Mr. Culbertson, who called himself “Android” online, conspired with another man, “Mike” from the Netherlands, to design a product called Dendroid and sell it on Darkode, an online marketplace for criminals and hackers.
Dendroid infected victims’ phones, allowing a customer who had bought the malware to spy on texts, pilfer files, take photos, review browser history and record conversations, all without the owners’ knowledge.
Mr. Culbertson later bought out Mike’s share of the partnership and started working with another individual identified as “Elzig,” Mr. Kitchen said, in an attempt to market Dendroid on Darkode.
Mr. Culbertson advertised the malware on Darkode for $300, saying he had spent “1.3 years” designing it, and also tried to auction the source code that would allow buyers to create their own version of Dendroid.
Ms. McNally said he didn’t get any offers on his auction attempt.
Following the plea, Judge Cohill allowed Mr. Culbertson to remain free on a $10,000 bond. An engineering student who has completed his sophomore year in the College of Engineering, he told the judge he has taken a leave of absence from CMU.
CMU spokesman Ken Walters said the university had no comment on the matter. Asked if the university had a policy against allowing a student to remain enrolled after being convicted of a felony, Mr. Walters said he did not know and he has forwarded the question to administrators.
The Carnegie Mellon Code of Conduct, which is available at the university’s website, states that students “are expected to meet the highest standards of personal, ethical and moral conduct possible. ... Students who cannot meet them should voluntarily withdraw from the university.”
Mr. Culbertson was among some 70 people targeted in an international investigation based in Pittsburgh that focused on Darkode, which has since been shut down by the FBI. Of those, seven are being prosecuted in Pittsburgh, including Mr. Culbertson.
A graduate of Winchester Thurston, a private school in Shadyside, Mr. Culbertson was described by those who know him as an intelligent, respectful and level-headed student who worked hard and excelled on the tennis team. He was said to have many friends and his parents were very involved in his life, never missing one of his tennis matches.
Three others involved with Darkode have entered guilty pleas in a spam scheme unrelated to Mr. Culbertson’s crime.
Dewayne Watts, 28, and Naveed Ahmed, 27, both of Florida, and Phillip Fleitz, 31, of Indianapolis, admitted to their roles in maintaining a spam botnet that used servers in China to infect routers in other countries and send millions of email messages designed to defeat spam filters of cellphone providers.
Torsten Ove: tove@post-gazette.com or 412-263-1504.
First Published: August 25, 2015, 4:22 p.m.
Updated: August 26, 2015, 12:23 a.m.
