System uses speed to find virus antidote

A program which allows antivirus vendors to protect users against rapidly spreading viruses by secure exchange of 'urgent' virus samples was launched today.

Revs, or Rapid Exchange of Virus Samples, enables antivirus developers worldwide to pool their resources in the fight to protect end users from the threat of rapidly spreading viruses such as Melissa.

The backbone of Revs is a server housed in a secure room at the headquarters of UK antivirus company Sophos. The server encrypts and forwards a secure copy of urgent viruses to all participating antivirus developers. This ensures that virus samples are received within minutes of a rapidly spreading virus being discovered.

The Revs mailing list is controlled by custom-built software which manages the encryption and exchange of urgent virus samples.

When a participant deems that a virus is urgent, a sample is encrypted using PGP, signed with the antivirus vendor's key and then sent to the Revs server. The system then resends the sample to the list participants, encrypting it correctly for each individual recipient.

Paul Ducklin, head of research at Sophos, said Revs is designed to supplement current mechanisms of virus exchange, which typically involve a combination monthly exchanges or ad hoc collaborations.

"This technology provides for near real-time exchange of virus samples that does not rely on individual people," said Ducklin. "It is a way of making sure we are one step ahead of the bad guys."

He said Revs is setting the framework for more rapid and reliable responses to rapidly spreading viruses. Any antivirus vendor can participate in the Revs messaging service free of charge.

"Unlike the medical profession, we don't need to send virus samples with armed guards," joked Ducklin.