CMU student who sold Android-infecting software sentenced to 3 years probation
A Carnegie Mellon University student on Monday was sentenced to three years probation, with 300 hours of community service and computer monitoring, for developing and selling malicious software that allowed others to remotely control Google Android smartphones.
Morgan Culbertson, 22, of Churchill pleaded guilty in August 2015 to conspiracy for his role in the malware distribution, which enabled those who bought the software to use the phones’ cameras to spy on their owners.
U.S. District Judge Arthur J. Schwab imposed the sentence, according to acting U.S. Attorney Soo C. Song.
Culbertson is one of 12 people living in the United States who were charged in the takedown of the Darkode cybercriminal marketplace in July.
Starting in 2013, Culbertson conspired to design and sell Dendroid on an online criminal marketplace known as Darkode, Assistant U.S. Attorney James Kitchen said.
The malware could hide itself within a legitimate Android app without affecting the app’s functioning. Culbertson designed the malware to avoid detection by anti-virus scanners and Google Play Store’s security features, Kitchen said.
Consequently, victims would download the app and Dendroid would then infect their phone, allowing the purchaser of the malware to steal files, take pictures, intercept text messages and record phone conversations, Kitchen said.