Tech bazaar Aria puts £10K bounty on heads of DDoS varmints

Manchester-based reseller Aria PC is offering a £10,000 bounty for information leading to the conviction of miscreants who hit its websites with a sustained denial-of-service attack this week.

In a forum post, Aria said it had already reported packet-flooding assaults against its main site and forum to the police, but wanted to go further by offering a Wild West-style reward.

The attacks caused Aria's websites to fall offline despite attempts to tighten up defences. No customer information was exposed, but the reseller is clearly fed up with fending off DDoS and arguable more serious automated hacking attempts, prompting a decision to put a price on the head or heads of its unknown assailants:

Since Sunday 24th of February and on each following day we have been subjected to a variety of attacks, in the form of DDOS (distributed denial of service) attacks on both the forum and the main shop site, and other automated attack attempts.

All attempts to find vulnerabilities have been unsuccessful – we regularly scan ourselves for such issues as part of our PCI compliance process – and our database and applications have not been compromised – credit card or other financial information is not stored by us and is therefore not available to an attacker, successful or otherwise. However the DDOS attacks will have caused some service outage on the forums, and to a lesser extent the main shop website.

Since this is a serious criminal matter the police are now involved in the investigation of these incidents, and we will be unable to comment in any detail on the on-going investigation. We apologise to our customers for any inconvenience they may experience, and we would like to assure you that every step is being taken to ensure that business continues as usual, and that all confidential customer data continues to be protected.

If anyone has any information which leads to the arrest and conviction of the individual(s) behind these attacks, we are offering a £10,000 reward. You might be his girlfriend, know him or them personally. Chances are that he/they are not going to be very popular. Just imagine what you can do with £10,000! A new car? Extension to the house? Pay off the loan? Latest gadgets?

At the time of writing on Friday morning both Aria's main website and forum appeared to be operating normally. Aria posted the reward on Wednesday but restricted access to this message on Thursday. El Reg has however been able to confirm that the offer is genuine.

Bounties for information leading to the arrest and conviction of computer hacking criminals are uncommon but not unprecedented in the computer industry. For example, Microsoft is offering a $250,000 reward for information that results in the arrest of botmasters behind the Rustock spam-spewing network. Redmond previously offered awards for the conviction of authors of high-profile worms, such as Conficker.

The only payout under the software giant's Anti-Virus Reward Program came when a German court convicted Sven Jaschan for creating a variant of Sasser, a nasty network worm, back in July 2005.

The Aria bounty matches the £10,000 put up by Overclockers.co.uk as a reward for information leading to the conviction of attackers who targeted the technology enthusiast site in a DDoS in January 2009. Aria boss Aria Taheri told us he already had some leads and other "useful information" as a result of its offer. This information has been passed onto the police but no arrests have been made. ®

Bootnote

Thanks to Reg reader Felix for the heads up on Aria's bounty.