A Carnegie Mellon University student faces up to ten years in prison for creating Android malware that allowed users to take control of other people’s devices. Morgan C. Culbertson, 20, hoped to sell “Dendroid” on the Darkode cybercrime forum.
Culbertson, a former intern at the cybersecurity company FireEye, pleaded guilty in federal court to developing Dendroid, which has the ability to steal photos, files, recorded phone conversations, and other personal data from Android-powered devices.
Dendroid was advertised on Darkode for $300, but it’s unclear if any copies were sold. Culbertson also advertised the malware’s source code, giving other hackers the ability to develop their own versions, but his lawyer, Emily McNally, said there were no offers for it.
“I am sorry to the individuals to whom my software may have compromised their privacy,” Culbertson told the court, according to Pittsburgh Post-Gazette.
U.S. District Judge Maurice Cohill Jr. allowed Culbertson to remain free on a $10,000 bond. He could face up to ten years in prison for his actions, but it’s thought he is unlikely to get “anywhere near” the maximum sentence.
Culbertson is one of 70 people targeted in an investigation focused on Darkode, the forum and marketplace that was created by hacking group Lizard Squad. It has now been shut down by the FBI.