How OUT works

OUT works on an email server. This is the place that is the traffic cop for all emails that bandy about the world. You have an email address me@YourEmailAddresss.com. There is a computer (or computers) somewhere in the world that designated as the computer called mail.YourEmailAddresss.com. All emails addressed to me@YourEmailAddresss.com go to this computer and get processed there. There they sit until you log in and grab them and read them.

Many email servers have the ability to run programs after the email comes in. This is where OUT takes over. We separate out the attachment and send it over to a fake PC (or series of fake PCs). We then instruct the fake PC to run the attachment.

What does that mean "run the attachment"? Well, if the attachment is a Word document, we run Word and load the document. If the attachment is an Excel spreadsheet, we start up Excel and load the spreadsheet. If the attachment is a program, we run the program, just like you would.

Simplistically we run the program several times, or look for macros in the documents and run them several times. We open and close the documents, we run the program on different days. We do a whole bunch of stuff.

And then we stop. And we analyze the results.

• Are files missing?

• Have files been changed?

• Does the computer work any differently now that we've run this program?

• Has this program tried to send emails?

• Has it tried to access other computers?

We check a whole series of tests, looking for aberrant behavior.