How OUT works
OUT works on an email server.
This is the place that is the traffic cop for all emails that bandy
about the world. You have an email address
There is a computer (or computers) somewhere in the world that
designated as the computer called mail.YourEmailAddresss.com. All
emails addressed to
me@YourEmailAddresss.com go to this computer and get processed
there. There they sit until you log in and grab them and read them.
Many email servers have the
ability to run programs after the email comes in. This is where OUT
takes over. We separate out the attachment and send it over to a
fake PC (or series of fake PCs). We then instruct the fake PC to run
What does that mean "run the
attachment"? Well, if the attachment is a Word document, we run Word
and load the document. If the attachment is an Excel spreadsheet, we
start up Excel and load the spreadsheet. If the attachment is a
program, we run the program, just like you would.
Simplistically we run the program
several times, or look for macros in the documents and run them
several times. We open and close the documents, we run the program
on different days. We do a whole bunch of stuff.
And then we stop. And we analyze
Are files missing?
files been changed?
the computer work any differently now that we've run this program?
program tried to send emails?
tried to access other computers?
We check a
whole series of tests, looking for aberrant behavior.