College student sentenced to probation for Android malware

A student at Carnegie Mellon University who developed and sold malware on the black market was sentenced to federal probation this week. 

Morgan Culbertson, who once interned at the cybersecurity company FireEye, was sentenced in federal court in Pittsburgh on Monday to three years probation, computer monitoring and 300 hours of community service after being convicted of attempting and conspiring to cause damage to others’ phones. 

Culbertson developed malware called “Dendroid” and sold it on Darkode, an online black market used by hackers that was later shuttered by the FBI. The malware was used to infect Google Android phones, allowing Culbertson and others to steal information stored on infected phones and to control the devices remotely.

{mosads}Culbertson, 22, was one of several individuals nabbed by authorities in 2015 in an international bust of Darkode. At the time, CNN reported that he had been an intern at FireEye, which suspended Culbertson’s internship after he was charged. He pled guilty to designing and selling the malware on Darkode in August 2015.  

Culbertson faced 10 to 16 months in prison for the crime. 

According to the local Pittsburgh Post-Gazette, the charge was Culbertson’s first offense. He has since used his computer skills interning at a company designing technology for the trucking industry.

Culbertson expressed remorse for his crime on Monday, telling the judge that he would be “haunted by this for the rest of my life.”