#passing forged cheques | Explore Tumblr posts and blogs

scarabbai · 4 years ago

Text

Dire Crowley is a man hard at work, one who wholeheartedly loves his school and every drop of sweat he’s shed while building, repairing, and maintaining its foundation. The scratch of his quill against parchment, the delicate yet deliberate lines of ink elegantly marking his documents, the low and thoughtful hum in his throat as he taps his claws against the table, all of it demonstrates his complete and utter concentration. New students, returning ones, management, fees, staff—he must keep track of it all, organizing existing assets and ordering whatever will be needed for the coming school year. With his mountain of tasks, he scarcely has the time to do anything, even things as simple as enjoying his afternoon tea! Ah, a true tragedy, but he mustn’t stop toiling away. Night Raven College is his pride and joy, and his continual efforts to care for it shall not cease even for a moment. He is kind, after all.

A knock at the door causes him to pause his writing, his quill suspended in midair as he stills. The wood remains unmoved as a ghost—Sir Mallow, one of his secretaries—phases his head through it. They blink at each other for a moment before the spectre clears his throat.

“Mister Crowley, sir?” Mallow brings the rest of his body inside, drifting into the room and hovering before Dire’s desk. “There’s someone here to see you.”

“A visitor? Asking for a meeting now?”

Dire brings a hand to his chin in consideration.

He doesn’t exactly enjoy being disturbed, especially when focused on such an arduous task, and this is rather sudden and unannounced. An excuse to chat or even stretch his legs a bit would be incredibly nice right about now, but he doesn’t have anything currently at the ready to entertain guests. Additionally, putting something together last minute would be a big hassle and not worth the trouble. Oh, unscheduled visits are such a headache to deal with even if they offer a much desired break from paperwork! It’s unfortunate, but he’ll have to decline.

“As much as I’d like to...” Dire heaves a dramatic, over-the-top sigh. “I’m rather busy at the moment. Could you please tell them to come at a later time?”

Sir Mallow wrings his hands—a habit much of the staff frequently point out—and frowns deeply. “That’s the thing, sir... He’s not taking no for an answer.”

“Hm?” Dire raises an eyebrow. “Who is?”

“One Mister Viper, sir.”

He snaps to attention at once, leaning forward in his chair. “Viper? As in, that Viper?”

Surely it couldn’t be that Mister Viper, meaning the famed noble of the Land of Hot Sands, with great power and even greater riches to his name? Of a family said to be the desendants of one of the Great Seven, the Sorcerer of the Desert himself? The man who recently graced the school with his presence, entering his office covered from head to toe in sparkling gold?

Just a couple weeks ago, Dire met with him to praise the flawless and outstanding performance his son—a quiet, brooding boy who spoke only once and glared viciously throughout the entire meeting—displayed during his entrance examinations. He congratulated him with utmost enthusiasm over his son’s acceptance to the school, expressing his overwhelming joy that the prestigious Viper family would even consider Night Raven College. Insisting the very institution was humbled by the Vipers’ presence, he quietly assured Mister Viper that his son would have been guaranteed a place at Night Raven even if he hadn’t passed. He would do anything to please the head of such an important family, after all.

Now, however, Dire is beginning to doubt the effectiveness of his previous displays of hospitality. Could it be that he upset the Vipers somehow? That would be disastrous! With their reputation and resources, they could easily destroy his school in just a few carefully planned moves. Surely that isn’t the case? Surely it is a mere misunderstanding, and Mister Viper isn’t the one knocking at his door?

Alas... “I believe so, Mister Crowley.”

Dread, cold and deep, crawls inside Dire’s chest. Despite this, he quickly wipes any apprehension from his features, turning his distressed frown into a warm, welcoming smile. After all, a good host never shows disdain in front of guests. Opening his arms with a cheerful and hearty laugh, he exclaims, “Well, why didn’t you say so! Please, let him in at once. We are kind, so we mustn’t keep our guest of honor waiting.”

Sir Mallow bows. “Yes, Crowley sir. Right away.”

The moment the ghost leaves the room, Dire leaps into action.

With a flick of his hand, magic surges outward. Stacks of both finished and unfinished paperwork burst into a flutter and begin to file themselves, sheet by sheet, away inside cabinets. Feather dusters spring to life and clean each and every exposed surface with mighty fervor. His work space rearranges itself, morphing from an office desk to an ornate tea table and placing down comfortable chairs. As he pulls his best tin of tea leaves out of a drawer, the table sets itself with his finest china and polished silverware. He rings the school chef for some refreshments to be prepared as quickly as possible before putting the kettle on and sitting down.

By the time Sir Mallow returns and knocks to announce the arrival of his guest, Dire is already pouring tea into his cup. “Do come in!” he chimes, his expression the epitome of cheer as the door creaks open.

He tries very hard not to go slack jawed in shock when it is not Mister Viper who enters his office—it is Mister Viper’s son!

Such an unexpected turn of events! Dire barely contains his sheer surprise and relief as he motions for the young Viper to take a seat, pouring tea for the young man.

The Viper heir—Jamil, he recalls his name was—carries himself with immense grace and poise as he sits across from him, as expected for someone of his social standing. Dire notes he’s looking much more composed and confident than the last time he saw him, his expression borderlining smug. How odd.

Nevertheless, he smiles brightly. “What a pleasure it is to see you again so soon, young Viper! You gave me quite the surprise, showing up unannounced the way you did. You must be tired from your trip here! Please, do have something to eat.” Dire gestures to the desserts lain out on the table, looking on with a pleased expression as the young man plucks a chocolate truffle from one of the trays. He waits for him to finish snacking on the sweet before continuing, “I must ask, are you here on behalf of your father? As I’m sure you remember, I met with him not long ago! He is a very outstanding and brilliant man, and he has many connections as well, correct? Ah, truly remarkable! Absolutely incredible! You know, I actually heard just last week he–”

“I’m not here to run my father’s errands,” Jamil states rather sharply. “I came here on my own. For my own reasons.”

“Oh!” Dire hadn’t even noticed the boy’s expression souring as he blathered on. Perhaps he hit a nerve. “I see,” he backtracks, toning down his enthusiasm. “Then what has brought you here today, young Viper?”

“I want to make a deal with you.”

“Hm?” Intriguing, but unrealistic. “With all due respect to your title, young Jamil, I don’t think it’s possible for me to–”

Out of thin air, the Viper heir materializes a glittering gold coin in his hand, holding it in front of Dire’s face. It gleams and glows like the sun even in the mediocre lighting of his office, and his eyes can’t help but follow its shiny surface as the coin sways back and forth. Crows adore sparkling trinkets after all, and Dire is no exception. Even as the gold piece is placed on the table, he remains greedily focused on it.

Just as he considers snatching it up for himself, the young man strikes, and the prize disappears back into his hand. He then tauntingly rolls the coin across his knuckles, showing off some sleight of hand and causing three more to appear before all four golden pieces vanish once more.

“Actually,” Jamil’s voice drips with arrogance as he nonchalantly examines his nails, “I think it is possible, Mister Crowley.”

Curse his feathers for being weak to such treasures! His inner crow can never resist such a dazzling gleam, and there might even be greater riches in waiting.

He must, at the very least, hear the offer.

Despite his immense irritation upon seeing the boy’s conceited smirk, Dire folds his hands and remains outwardly civil. “I’m listening.”

The Viper’s victorious grin turns downright egotistical as he sets down seven positively radiant golden discs between them. Pushing the coins toward Dire, he states his order:

“Fetch two files for me. I need records changed, information altered, and details fabricated. I’ll give you a basic story. Make it believable, and forge the evidence to back it up if need be.”

“And,” he silences the complaints on the tip of Dire’s tongue with a raised hand, “I want you to make it untraceable. No proof, no messiness. Like everything’s always been that way.”

The allure of the gold is tempting, but even Dire eyes the little snake and his offerings with suspicion. Such a sudden and specific request, and with so much to it as well! How troublesome. His lips curved downward in the smallest of frowns, he counters, “Now, young Jamil... What, pray tell, gives you the idea that I am capable of doing such things? I am merely the headmaster of a school, you know.”

The boy has the gall to laugh in his face.

With dramatic flourish, Jamil opens his hand to reveal a crisp slip of paper. Holding it up between his fingers, he waves it around in a mocking manner before placing it face down and sliding it across the table.

“See if this will change your mind.”

When Dire picks it up, his eyes nearly pop out of their sockets in shock, and his head spins with the number of zeroes staring him in the face.

Jamil, on the other hand, doesn’t even bat an eyelash as Crowley fusses over the cheque. Instead, he takes a moment to preen and bask in the glory of his success before growing bored, rolling his eyes, and snapping his fingers to get the attention back on him.

“You may be downplaying your talents in an attempt to worm your way out of this, but I know the truth.” He points a finger directly at the headmaster’s face. “You’re a powerful man, Mister Crowley. I’m sure you can figure it out and get the job done.”

The man—fae?—changes his tune quick as he pockets the bribes, becoming pleasant and cheerful once more. “Young Jamil, I will fulfill your request!” he declares in a booming voice. Then, in a much quieter one, he adds, “I shall listen, for I am kind.”

Jamil’s lips curl into a devious smile. Perfect.

“That’s what I thought.” He leans back in his chair. “Now, here’s what I have in mind...”

#twisted wonderland #twst #twst fic #dire crowley #twst crowley #jamil viper #twst jamil #role reversed au #my stuff #ahhh this took so long to write...like probably a week or more #might post this to ao3 as well

88 notes · View notes

health-is-in-you · 4 years ago

Photo

From Enough 14.

Social rebel, counterfeiter, bandit, modern Robin Hood – the list of titles with which our anarchist comrade Lucio Urtubia was honoured is long. His life, which sounds like an adventure novel, is a mirror of the revolutionary movements in Europe in the second half of the 20th century. Lucio Urtuba passed away today (18 July, 2020). Rest In Power Lucio!

Lucio Urtubia was born in 1931 in a small village in Navarre and grew up in poor conditions. When he was called up for military service, he deserted to France shortly afterwards, where he worked as a bricklayer from then on. He came into contact with anarchist groups and met his political foster father: the legendary Sabaté, who organized the armed resistance against the Franco dictatorship from France. Forging documents, hiding underground fighters and illegal fundraising activities play a major role in his life from then on. Numerous resistance organisations, which have a base of operations in France or are looking for a place to retreat, benefit from his skills: Black Panthers, Tupamaros, European guerrillas. Lucio’s solidarity is with every act of revolt aimed at a more just social order.

In 1962, he proposed to Che Guevara, then head of the National Bank of Cuba, to flood the world market with counterfeit dollar bills in order to destabilize the US economy. The proposal meets little approval on the Cuban side, but the idea remains alive in Lucio. In 1980 he succeeds in his greatest coup: by printing traveller’s cheques from Citibank with a value of several million dollars he brings the then most powerful bank in the world on its knees.

But the list of his activities is not completed. Lucio is also a master of conspiracy, however, who manages to spend only a few months in prison in his not exactly law-abiding life. He breaks the silence at the age of well over 70. There is a book and also a movie (Watch here) about Lucio Urtubia.

Lucio, The Good Bandit: Reflections of an Anarchist Marie Trigona, Toward Freedom (05/06/2008)

Outspoken and charismatic, Lucio speaks like a true anarchist. When asked what it means to be an anarchist, Lucio refutes the misperception of the terrorist, “The anarchist is a person who is good at heart, responsible.” Yet he makes no apologies for the need to destroy the current social order, “it’s good to destroy certain things, because you build things to replace them.”

Lucio has old friends in the Southern Cone. Funds from the forgery operatives helped hundreds from revolutionary organizations exile and finance clandestine actions against the bloody dictatorships which disappeared ten thousands of activists, students and workers during the 1970’s throughout Latin America. In Uruguay, funds from falsified Citibank travelers’ checks funded the guerilla group Tupamaros, in the US the Black Panthers and other revolutionary groups throughout Europe.

During his recent visit to South America, Lucio stayed at the worker run BAUEN Hotel in Argentina’s capital Buenos Aires. He was astounded by the accomplishments of the workers without bosses. At the BAUEN hotel, workers are putting into practice workers autogestíon or self-management. Self-management has been a mainstay of anarchist thought since the birth of capitalism. Rather than authority – obey relationship between capitalists and workers, self-management implies that workers put into practice an egalitarian system in which people collectively decide, produce and control their own destinies for the benefit of the community. But for such a system to work, participants have to be hard working and responsible, one of the most important attributes a man or woman should have according to Lucio. “The anarchist movement was built by workers. Without work we can’t talk about self-management, to put self-management into practice we need to know how to do things, to work. It’s easy to be bohemian.”

Lucio explains that his anarchism is based in his poor childhood in fascist Spain. “My anarchist origins are rooted in my experience growing up in a poor family. My father was leftist, had gone to jail because he wanted the automony of the Basque country. For me that’s not revolution, I’m not nationalist. With nationalism humanity has committed a lot of mistakes. When my father got out of jail he became a socialist. We suffered a lot. I went to look for bread and the baker wouldn’t give it to me, because we didn’t have money. For me poverty enriched me, I didn’t have to make any effort to lose respect for the establishment, the Church, private property and the State.”

In Spain, fascism persevered 30 years after the end of World War II. Hundreds were placed in jail for resisting the Franco dictatorship. Anthropologists have estimated that from the onset of the Spanish Civil War in July 1936 to Franco’s death in November 1975, Franco’s Nationalists killed between 75,000 and 150,000 supporters of the Republic.

Lucio exiled to France where he discovered anarchism. He had deserted the nationalist army and escaped to France. Paris in the 1960’s was a bourgeoning city for anarchist intellectuals, organizers and guerillas in exile. It was there that Lucio met members from the anarcho-syndicalist trade union, Confederación Nacional de Trabajo (CNT). He was anxious to participate.

During his early years in France, Lucio met Francisco Sabate, the legendary anarchist and guerilla extraordinaire. At this time Sabate, otherwise known by his nickname “El Quico” was the most sought after anarchist by the Franco regime. French police were also looking for Sabate, who led resistance against Franquismo. “When I met Quico, I was participating in the Juventud Libertarias. They asked me if I could help Sabate, me an ignorant, I didn’t know who he was.” Sabate used Lucio’s house as a hide out. The young Lucio, listened to Sabate’s tales of direct action and absorbed whatever wisdom he had to offer, like methods for sniffing out infiltrators. “I met guerillas that put me on the road to direct action and expropriations. Sabate taught me to lose respect for private property.”

It was then that Lucio began participating in bank robberies. “There are no bigger crooks than the banks,” says Lucio in the defense of expropriation. “[This was the] only means the anarchist had, without funding from industry or government representatives to fund them. The money was sent to those suffering from Franco’s regime.” Student organizations and worker organizations received the funds to carry out grass roots organizing. In other cases the money was used for the guerilla actions against Franco’s regime, such as campaigns for the release of political prisoners in the nationalist jails.

To save the lives of exiles, Lucio thought of a master plan to falsify passports so Spanish nationals could travel. “Passports for a refugee means being able to escape the country and lead safe lives elsewhere,” he explains. Not only in Europe but in the US and South America, dissidents used false ID’s to lead their lives and direct actions.

In 1977, Lucio’s group began forging checks as a direct form to finance resistance. Lucio was essentially the “boss” of the operation-he made, distributed and cashed the checks. The checks were harder to falsify than counterfeit bills. Lucio thought they should target the largest banking institution in the world, National City Bank. The distribution of the checks went to different subversive groups who used the funds to finance solidarity actions. Lucio explains that “no one got rich” from the checks. Most of the funds went to the cause. All over Europe, these checks with the same code number were cashed at the same time.

Lucio’s master plan cost City Bank tens of millions of dollars in forged travelers’ checks. But many say a much larger sum was expropriated. City Bank was at the mercy of the forger, who had cost so much that the bank had to suspend travelers checks, ruining the holiday for thousands of tourists. At the time, people did not use check cards or credit cards. Lucio was arrested in 1980 and found with a suitcase full of the forged checks. In the meantime during Lucio’s arrest, Citibank continued to receive false travelers’ checks.

Citbank became worried. Representatives from the bank agreed to negotiate. Lucio would be released if he handed over the printing plates for the forged checks. The exchange was made, and Lucio became a legend for his mastermind plan. Although his life as a forger ended at 50-years-of-age, his life as an anarchist continued.

Lucio had always worked as a bricklayer. “What’s helped me the most is my work, Anarchists were always workers.” Lucio-bricklayer, anarchist, forger and expropriator has left a legacy like his predecessors. “People like Loise Michel, Sabate, Durruti, all the expropriators taught me how to expropriate, but not for personal gain, but how to use those riches for change.” At 76-years-of-age he does not apologize for his actions. “I’ve expropriated, which according to the Christian religion is a sin. For me expropriations are necessary. As the revolutionaries say, robbing and expropriation is a revolutionary act as long as one doesn’t benefit from it.”

#anarchist #anarchy #Expropriation #illegalism #anarchist history

78 notes · View notes

arfox158 · 3 years ago

Text

5m Mathmrs. Mac's Messages

TLDR: With a bit of research and support we were able to demonstrate a proof of concept for introducing a fraudulent payment message to move £0.5M from one account to another, by manually forging a raw SWIFT MT103 message, and leveraging specific system trust relationships to do the hard work for us!

5m Mathmrs. Mac's Messages App

5m Mathmrs. Mac's Messages Message

5m Mathmrs. Mac's Messages To My

5m Mathmrs. Mac's Messages For Her

Before we begin: This research is based on work we performed in close-collaboration with one of our clients; however, the systems, architecture, and payment-related details have been generalized / redacted / modified as to not disclose information specific to their environment.

A desktop application for Instagram direct messages. Download for Windows, Mac and Linux.

Have a question, comment, or need assistance? Send us a message or call (630) 833-0300. Will call available at our Chicago location Mon-Fri 7:00am–6:00pm and Sat 7:00am–2:00pm.

5m Mathmrs. Mac's Messages App

With that said.. *clears throat*

The typical Tactics, Techniques and Procedures (TTPs) against SWIFT systems we see in reports and the media are - for the most part - the following:

Compromise the institution's network;

Move laterally towards critical payment systems;

Compromise multiple SWIFT Payment Operator (PO) credentials;

Access the institution's SWIFT Messaging Interface (MI);

Keys in - and then authorize - payment messages using the compromised PO accounts on the MI.

This attack-path requires the compromise of multiple users, multiple systems, an understanding of how to use the target application, bypass of 2FA, attempts to hide access logs, avoid alerting the legitimate operators, attempts to disrupt physical evidence, bespoke malware, etc. – so, quite involved and difficult. Now that’s all good and fine, but having reviewed a few different payment system architectures over the years, I can’t help but wonder:

“Can't an attacker just target the system at a lower level? Why not target the Message Queues directly? Can it be done?”

A hash-based MAC might simply be too big. On the other hand, hash-based MACs, because they are larger, are less likely to have clashes for a given size of message. A MAC that is too small might turn out to be useless, as a variety of easy-to-generate messages might compute to the same MAC value, resulting in a collision. WhatsApp Messenger is a FREE messaging app available for iPhone and other smartphones. WhatsApp uses your phone's Internet connection (4G/3G/2G/EDGE or Wi-Fi, as available) to let you message and call friends and family. Switch from SMS to WhatsApp to send and receive messages, calls, photos, videos, documents, and Voice Messages. WHY USE WHATSAPP. Garrick Hello, I'm Garrick Chow, and welcome to this course on computer literacy for the Mac. This course is aimed at the complete computer novice, so if you're the sort of person who feels some mild anxiety, nervousness, or even dread every time you sit down in front of your computer, this course is for you.

Well, let's find out! My mission begins!

So, first things first! I needed to fully understand the specific “section” of the target institution's payment landscape I was going to focus on for this research. In this narrative, there will be a system called “Payment System” (SYS). This system is part of the institution's back-office payment landscape, receiving data in a custom format and output's an initial payment instructions in ISO 15022 / RJE / SWIFT MT format. The reason I sought this scenario was specifically because I wanted to focus on attempting to forge an MT103 payment message - that is:

In this video I will show you where to locate the serial number on a Western golf cart. Ebay Store: Please SUBSCRIBE. Western golf cart serial number lookuplastevil.

MT – “Message Type” Literal;

1 – Category 1 (Customer Payments and Cheques);

0 – Group 0 (Financial Institution Transfer);

3 – Type 3 (Notification);

All together this is classified as the MT103 “Single Customer Credit Transfer”.

Message type aside, what does this payment flow look like at a high level? Well I’ve only gone and made a fancy diagram for this!

Overall this is a very typical and generic architecture design. However, let me roughly break down what this does:

The Payment System (SYS) ingests data in a custom - or alternative - message format from it's respective upstream systems. SYS then outputs an initial payment instruction in SWIFT MT format;

SYS sends this initial message downstream to a shared middelware (MID) component, which converts (if necessary) the received message into the modern MT format understood by SWIFT - Essentially a message broker used by a range of upstream payment systems within the institution;

MID forwards the message in it's new format on to the institution's Messaging Interface (let's say its SAA in this instance) for processing;

Once received by SAA, the message content is read by the institution's sanction screening / Anti-money laundering systems (SANCT).

Given no issues are found, the message is sent on to the institution's Communication Interface (SWIFT Alliance Gateway), where it's then signed and routed to the recipient institution over SWIFTNet.

OK, so now I have a general understanding of what I'm up against. But if I wanted to exploit the relationships between these systems to introduce a fraudulent payment without targeting any payment operators, I was going to need to dig deeper and understand the fundamental technologies in use!

So how are these messages actually 'passed' between each system? I need to know exactly what this looks like and how its done!

More often than not, Message Queues (MQ) are heavily used to pass messages between components in a large payment system. However, there are also various “Adapter” that may be used between systems communicating directly with the SAG (Such as SAA or other bespoke/3rd party systems). These are typically the:

Remote API Host Adapter (RAHA);

MQ Host Adapter (MQHA);

Web Services Host Adapter (WSHA).

Having identified that MQ was in use, my initial assumption was that there was most likely a dedicated Queue Manager (QM) server somewhere hosting various queues that systems push and pull messages from? However, due to SWIFT CSP requirements, this would most likely - at a minimum - take the form of two Queue Managers. One which manages the queues within the SWIFT Secure Zone, and another that manages queues for the general corporate network and back office systems.

Let's update that diagram to track / represent this understanding: Now I could research how this 'messaging' worked!

There are multiple ways to configure Message Queues architectures, in this case there were various dedicated input and output queues for each system, and the message flow looks something like this: Full disclosure, turns out it’s hard to draw an accurate - yet simple - MQ flow diagram (that one was basically my 4th attempt). So it’s.. accurate 'enough' for what we needed to remember!

5m Mathmrs. Mac's Messages Message

Now I had a good understanding of how it all worked, it is time to define my goal: 'Place a payment message directly on to a queue, and have it successfully processed by all downstream systems'.

This sounds simple, just write a message to a queue, right? But there are a few complications!

Why are there few indications of this attack vector in the wild?

How do I even gain “write” access to the right queue?

What protects the message on the queues?

What protects the messages in transit?

What format are the messages in?

What is the correct syntax for that message format at any particular queue (0 margin for error)?

Where does PKI come in? How / where / when are the messages signed?

Can I somehow get around the message signing?

What values in the messages are dependent / controlled / defined by the system processing them (out of my control)?

What is the maximum amount I can transfer using Straight Through Processing, without alerting the institution / requiring manual validation?

But OK, there's no point dwelling on all of that right now, I'll just clearly define what I want to do! The goal:

Successfully write a payment instruction for 500,000 GBP;

Inject that message directly onto a specific queue;

Have the message pass environment-specific validation rules;

Have the message pass sanctions and AML checks.

Have the message successfully signed;

Have the message pass SWIFTNet-specific validation rules;

What I was not interested in doing for this research - yet needed to understand nevertheless for a full attack chain was:

How to compromise the institution's network;

How to gain access to the MQ admin's workstation;

How to obtain the pre-requisite credentials.

What I wanted to 100% avoid at all costs:

The attack involving SWIFT payment operators in any way;

The attack involving SWIFT application access in any way;

A need to compromise signing keys / HSMs;

A need to compromise SWIFTNet operator accounts or certificates or any type of PKI;.

Now I had an idea of what to do, I needed to make sure I could write a raw MT103 payment instruction! Typically, even when operators write payment messages using a messaging interface application like Alliance Access, they only really write the message “body” via a nice GUI. As raw data this could look something like:

I'll break this down in the following table:

NameFieldValueTransaction Reference20TRANSACTIONRF103Bank Operation Code23BCRED (Message is to 'credit' some beneficiary)Value Date / Currency / Amount32A200102 (02/01/2020) GBP 500,000.00Currency / Original Credit Amount33BGBP 500000,00 (£500,000.00)Ordering Customer50KGB22EBNK88227712345678 (IBAN) JOHN DOE (Name) JOHN'S BUSINESS LTD (Line 1) 21 JOHN STREET, LONDON, GB (Line 2)Beneficiary59KFR20FBNK88332287654321 (IBAN) ALICE SMITH (Name) ALICE'S COMPANY (Line 1) 10 ALICE STREET, PARIS, FR (Line 2)Remittance Information7012345-67890 (essentially a payment reference)Details of Charge71ASHA (Shared charge between sender and receiver)

Now as this is a valid message body, if I were targeting a payment operator on SWIFT Alliance Access, I could - for the 'most' part - simply paste the message into SAA's raw message creation interface and I'd be pretty much done. With the exception of adding the sender / recipient BIC codes and most likely selecting a business unit. However, these values are not stored in the message body. Not stored in the message body you say? Well that complicates things! Where are they stored exactly?

The message “body” is referred to as “block 4” (aka the “Text Block”) within the SWIFT MT standard. As suggested by the name, there is probably also a block 1-3. This is correct; and these blocks are typically generated by the payment processing applications - such as SWIFT Alliance Access - and not necessarily input by the operators. A 'complete' MT103 message consists of 6 blocks:

Block 1 – Basic Header

Block 2 – Application Header

Block 3 – User Header

Block 4 – Text Block

Block 5 – Trailer

Block 6 – System block

So it looked like I was going to need to learn how to craft these various “blocks” from scratch.

Block 1 (Basic header)

Reading through some documentation, I crafted the following “Basic header” block:

A breakdown of what this translates too is as follows:

NameValueContextBasic Header Flag1Block 1 (Not 2, 3, 4, or 5)Application TypeFFIN ApplicationMessage Type0101 = FIN (I.e not ACK/NACK)Sender BICEBNKGB20EBNK (Bank Code) GB (Country Code) 20 (Location Code)Sender Logical TerminalATypically A, unless they are a significantly large institution and require multiple terminalsSender BranchXXXAll X if no branch neededSession Number0000The session number for the messageSequence Number 999999The sequence number of the message

Taking a step back, I already identified two potential problems: the “session” and “sequence” numbers! These are described as follows:

Session Number – Must also equal the current application session number of the application entity that receives the input message.

Sequence number – The sequence number must be equal to the next expected number.

Hmmm, at this point I was not sure how I could predetermine a valid session and/or sequence number - considering they seemed to be application and 'traffic' specific? But there was nothing I could do at the time, so I noted it down in a list of 'issues/blockers' to come back to later.

Block 2 (Application Header)

A bit more dry reading later, I managed to also throw together an application header:

Again, I’ve broken this down so it makes sense (if it didn’t already; I’m not one to assume):

NameValueContextApplication Header Flag2Block 2I/O IdentifierIInput Message (a message being sent)Message Type103103 = Single Customer Credit TransactionRecipient BICFBNKFR20FBNK (Bank Code) FR (Country Code) 20 (Location Code)Recipient Logical TerminalXAll General Purpose Application Messages must use 'X'Recipient BranchXXXAll General Purpose Application Messages must use 'XXX'Message PriorityNNormal (Not Urgent)

Awesome! No issues crafting this header!

Note: At this point I should probably mention that these BIC codes are not 'real', however are accurate in terms of in format and length.

Block 3 (User Header)

The third block is called the “User Header” block, which can be used to define some “special” processing rules. By leverage this header, I could specify that the message should be processed using “Straight Through Processing” (STP) rules which essentially attempts to ensure that the message is processed end-to-end without human intervention. This could be specified as follows:

However, this was not yet a valid header! As of November 2018 the user header requires a mandatory “Unique end-to-end transaction reference” (UETR) value, which was introduced as part of SWIFT's Global Payments Innovation initiative (gpi)! This is a Globally Unique Identifier (GUID) compliant with the 4th version of the generation algorithm used by the IETF standard 'RFC4122'. This consists of 32 hexadecimal characters, divided into 5 parts by hyphens as follows:

where:

x – any lowercase hexadecimal character;

4 – fixed value;

y – either: 8, 9, a, b.

This value can be generated using Python as seen below:

With an acceptable UETR generated, this is how the third block looked:

And as before, a breakdown can be found below:

NameValueContextUser Header Flag3Block 3Validation Flag119Indicates whether FIN must perform any type of special validationValidation FieldSTPRequests the FIN system to validate the message according to the straight through processing principlesUETR Field121Indicates the Unique end-to-end transaction reference valueUETR Value8b1b42b5-669f-46ff-b2f2-c21f99788834Unique end-to-end transaction reference used to track payment instruction

Block 5 and 6 (Trailer and System Blocks)

I’ve already discussed “block 4” (the message body), so to wrap this section up, I'll be looking at the final 2 blocks: Block 5, aka the “Trailer”; and block S, aka the “System” block.

Before going forward, let me take a moment to explain the pointlessly complicated concept of input and output messages:

An “input” message (I) is a message which is traveling “outbound” from the institution. So this is a message being “input” by an operator and sent by the institution to another institution.

An “output” message (O) is a message which is traveling “inbound” to the institution. So this is a message being “output” by SWIFTNet and being received by the institution.

OK, moving swiftly (aaaahhhhh!) on.

For Input messages, these blocks were not too much of a problem. The headers only really seemed to be used to flag whether the message was for training / testing or to flag if it was a possible duplicate, which syntactically took the following form:

Where “TNG” indicated “training” and “SPD” indicated “possible duplicate”.

However, with Output messages, it got considerably more complicated. An example of what the trailer and system block could look like on an Output message is the following:

A breakdown of these various values is:

Trailer ((5:) MAC – Message Authentication Code calculated based on the entire contents of the message using a key that has been exchanged with the destination bank and a secret algorithm; CHK – This is a PKI checksum of the message body, used to ensure the message has not been corrupted in transit; TNG – A flag to indicate that the message is a Testing and Training Message.

System ((S:) SPD – Possible Duplicate Flag SAC – Successfully Authenticated and Authorized Flag. This is only present if:

Signature verification was successful.

RMA (Relationship Management Application) authorization and verification was successful.

COP – Flag indicating that this is the primary message copy; MDG – The HMAC256 of the message using LAU keys.

However, these seemed to only be values I would need to consider if I was to try and forge an “incoming” message from SWIFTNet or an 'outbound' message on the output of the SAG.

So.. I'll stick with crafting an “input' message trailer:

Now, having said all that, it turned out the trailer block did seem to sometimes hold a MAC code and a message checksum (sigh), meaning I actually needed to construct something like:

So that was +2 to my 'issues/blockers' list. However, issues aside, I now understood the complete message format, and could put it all together and save the following as a draft / template MT103 message:

Highlighted in bold above are the areas of the message I was - at this point - unable to pre-determine. Nevertheless, a summary of what that the message describes is:

Using the transaction reference “TRANSACTIONRF103”;

please transfer 500,000.00 GBP;

from John Doe, (IBAN: GB22EBNK88227712345678) at “English Bank” (BIC: EBNKGB20);

to Alice Smith (IBAN: FR20FBNK88332287654321) at “French Bank” (BIC: FBNKFR20);

Furthermore, please ensure the transaction charge is shared between the two institutions;

and mark the payment with a reference of “12345-67890”.

To wrap up this section, i wanted to take a moment to explain some logic behind the target of 500,000 GBP, as it is also important.

Aside from the many reasons it would be better to transfer (even) smaller amounts (which is an increasingly common tactic deployed by modern threat actors), why not go higher? This is where it’s important to understand the system and environment you are targeting.

In this instance, let's assume that by doing recon for a while I gathered the understanding that:

If a message comes from SYS which is over £500k;

even if it has been subject to a 4 eye check;

and even if it is flagged for STP processing;

route it to a verification queue and hold it for manual verification.

This was because a transaction over £500k was determined to be “abnormal” for SYS. As such, if my transaction was greater, the message would not propagate through all systems automatically.

OK, so now that I understood:

how the system worked;

how it communicated;

the fundamental structure of a raw MT103 payment messages;

and how much I could reliably (attempt) to transfer.

And with that, it was time to take a break from MT standards and establish an understanding of how I would even get into a position to put this into practice!

To place a message on a queue, I was going to need two things:

Access to the correct queue manager;

Write access to the correct queues.

Depending on the environment and organisation, access to queue managers could be quite different and complex. However a bare-bones setup may take the following form:

An MQ Administrator accesses their dedicated workstation using AD credentials;

They then remotely access a dedicated jump server via RDP which only their host is whitelisted to access;

This may be required as the queues may make use of Channel Authentication Records, authorizing specific systems and user accounts access to specific queues;

The channels may further be protected by MQ Message Encryption (MQME) which encrypts messages at rest based on specific channels. As such, even if someone was a “super duper master admin” they would only be able to read / write to queues specifically allocated to them within the MQME configuration file (potential target for another time?);

The MQ Admin can then use tools such via the Jump Server to read/write to their desired message queues.

So, in this scenario, to gain access to the message queues I - as an attacker - would need to compromise the MQ admin’s AD account and workstations, then use this to gain access to the jump host, from where I could then access the message queues given I knew the correct channel name and was configured with authorization to access it.. and maybe throw some MFA in there..

That is understandably a significant requirement! However, when discussion sophisticated attacks against Financial Market Infrastructure (FMI), it is more than reasonable to accept that an Advanced Persistent Threat (APT) would see this as a feasible objective - We don't need to dig into the history of how sophisticated attacks targeting SWIFT systems can be.

Next, it was time to finally identify a feasible attack vector for message forgery.

Now with an idea of how to gain the right access, as well as an understanding of the various technologies and security controls in place; I update my diagram:

You may have noticed I've added something called “LAU” around the SAA-to-SAG adapter, and another “LAU” to the MID-to-SAA MQ channels, which I have yet to explain. “Local Authentication” (LAU) is a security control implemented by SWIFT to authenticate messages using a pair of shared keys between two systems. These keys are combined and used to generate a SHA256 HMAC of the message and append it to the S block. This can then be validated by the recipient system. Effectively, this validates the origin and authenticity of a message. As such, even if an attacker was in position to introduce a fraudulent payment, they'd first need to compromise both the left and the right LAU signing keys, generate the correct HMAC, and append it to the message in order to have it accepted / processed successfully.

But LAU aside, I now just needed to figure out which queue to target! There were a lot of queues to work with as each system essentially has multiple “input” and “output” queues. With that in mind, it was important to note that: an incoming message would require being in the format expected by the target system (from a specific upstream system) and an outgoing message would need to be in the format “produced” by one target system and “expected / ingested / processed” by its respective downstream system. So to figure this out, I worked backwards from the Gateway.

Targeting SAG

This was the least feasible attack vector!

I hadn't really looked into how the SWIFT adapters worked - If only I could research literally everything);

SAA and SAG implemented LAU on messages sent between them - An excellent security control!;

The output of SAG was directly on to SWIFTNet which would entail all sorts of other complications - this is an understatement)!

Next!

Targeting SAA

So what if I wanted to drop a message on the “outbound” channel of SAA?

LAU and the SWIFT adapter aside, remember those session and sequence numbers? Well, messages which leave SAA are in the near-final stages of their outbound life-cycle, and as far as I understood would need to have valid session and sequence values. Given I didn't know how to generate these values without gaining access to SAA or how they worked in general (and lets not forget the LAU signing) this didn't currently seem feasible.

Next!

Targeting SANCT

This solution didn't actually transport messages back and forth; it just reads messages off the queues and performed checks on their details. Not much I could wanted to leverage here.

Targeting MID

To target MID, I could try and inject a message onto SAA’s “input” queue, or the “output” queue of MID. This would only need to match the format of messages produced by the Middleware solution (MID). Following this, in theory, the (mistial) message session and sequence number would be added by SAA, along with the UETR. This was promising!

However, MID was a SWIFT “message partner”, which are typically solutions developed using the Alliance Access Development Kit that allows vendors to develop SWIFTNet compatible software, and consequentially, implement LAU. So again, in-order to forge a message here, I’d need to compromise the left and right LAU signing keys used between SAA and MID, manually HMAC the message (correctly!), and then place it on the correct queue.. This also no longer looked promising..

Targeting SYS

OK, how about the input of the next system down - the 'Payment System'?

5m Mathmrs. Mac's Messages To My

As described previously, the inbound data was a custom “application specific” payment instruction from the institutions back office systems, and not a SWIFT MT message. This would be an entirely new core concept I'd need to reverse - not ideal for this project.

But how about the output queue?

Although SYS received custom format data, I found that it output what seemed to be an initial SWIFT MT messages. This was perfect! Additionally, SYS did not have LAU between itself and MID because (unlike MID) SYS was not a SWIFT message partner, and was just one of many-many systems within the institution that formed their overall payment landscape.

Additionally, because SYS was esentially just one small piece of a much larger back office architecture, it was not part of the SWIFT Secure Zone (after all you cant have your entire estate in the Secure Zone - that defeats the purpose) and as such, made use of the Queue Manager within a more accessible section of the general corporate environment (QM1). Konica minolta bizhub c352 driver mac os xcompubrown recovery tool.

With this in mind, and having - in theory - compromised the MQ admin, I could leverage their access to access on the corporate network to authenticate to QM1. I could - in theory - then write a fraudulent payment message to the SYS “output” queue, which we will call “SYS_PAY_OUT_Q” from here on.

OK! It seems like I finally had an idea of what to do! But before I could put it into practice, I of course needed to create a diagram of the attack:

I think it’s important to take a minute to refer back to the concept of “trust” which is what lead to this attack diagram. My theory behind why this may work is because the MID application, implicitly trusts whatever it receives from its respective upstream systems. This is intentional, as by design the security model of the payment landscape ensures that: at any point a message can be created, a 4 (or 6) eye check is performed. If there was a system whose purpose it was to ensure the validity of a payment message at any point upstream, the downstream systems should have no real issue processing that message (with some exceptions). After all, It would be next to-impossible to maintain a high-throughput payment system without this design.

And with that said, the plan was now clear:

Leverage the access of a Message Queue administrator;

to abuse the “trust relationship” between SYS, MID, and SAA;

to introduce a fraudulent payment message directly on to the output queue of SYS;

by leaning on my new found understanding of complete MT103 payment messages.

It was finally time to try to demonstrate a Proof-of-Concept attack!

So at this point I believe I had everything I needed in order to execute the attack:

The target system!

The message format!

The queue manager!

The queue!

The access requirements!

The generously granted access to a fully functional SWIFT messaging architecture! (that’s a good one to have!)

The extra-generously granted support of various SMEs from the target institution! (This was even better to have!)

Message Forgery

I needed to begin by creating a valid payment message using valid details from the target institution. So before moving on I was provided with the following (Note: as with many things in this post, these details have been faked):

Debtor Account Details – John Doe, GB12EBNK88227712345678 at EBNKGB20

Creditor Account Details – Alice Smith, GB15EBNK88332287654321 at EBNKGB20

Some of you may have notice that the sending and receiving BIC’s are the same. This was because, for the sake of the research, I wanted to send the message back to the target institution via SWIFTNet so that I could analyse its full end-to-end message history. Furthermore, you may have noticed we are using 'test & training' BIC code (where the 8th character is a 0) - this was to make sure, you know, that I kept my job.

But yes, with access to these 'valid' account details and the knowledge gained during the research so far, I could now forge a complete Input MT103 messages:

Note: Field 33B is actually an optional field, however, the MT standard stated that “If the country codes of both the Sender’s and the Receiver’s BIC belong to the country code list, then field 33B is mandatory”. As such, if 33B was not present in the message, it would fail network validation rules and SWIFTNet would return a NAK with the error code: D49.

Optional / Mandatory fields aside, it was not quite that simple! There were a few minor changes I needed to make based on the specific point in the message's its life-cycle I was planning to introduce it!

As I list these changes, remember that the objective is to introduce the message to the output queue of SYS (Which exists before MID, SAA and SAG)

The first 3 blocks needed to be placed on a single line;

Remove field 121 (UETR) from the User Header, as this would be generated by SAA during processing;

Remove 1 character from the transaction reference as it needed to be exactly 16 characters (classic user error);

Add decimal point to transaction amount using a comma - otherwise it would fail syntax validation rules;

Ensure the IBAN's were real and accurate, otherwise it seemed the message would fail some type of signature validation on the SWIFT network. The IBANs are fake here, but during the real PoC we used accurate account details in collaboration with the target institution;

Remove the trailer block (5) - as this would be appended by SAA during processing;

Remove the System Block (S) - as this would be completed by the SAG.

And the final message was as follows:

Note that the location in which I introduce the message has resolved all of the 'issues / blockers' I'd tracked whilst researching the message structure! It would seem the further upstream you go, the easier the attack becomes - given MQ is still used as a transport medium.

Message Injection

Now I had my raw MT103 message, I just need to save it to a file (“Message.txt” - sure why not) and place onto the “SYS_PAY_OUT_Q” queue using one of the admin's tools:

With access to a sole MQ Administrator's AD account;

We connect to the MQ admins machine;

Log into the Jump Server;

Open our MQ tools of choice and authenticate to queue manager (QM1) where the output queue for SYS was managed;

Connected to the 'SYS_PAY_OUT_Q' queue;

Selected my forged “Message.txt” file;

Invoked the “write to queue” function;

And it was off!

Loggin in to Alliance Access and opening the message history tab, we sat awaiting for an update. Waiting, waiting, waiting… waiting… and..

ACK! It worked!

That's a joke; did we hell receive an ACK!

See, this last section is written slightly more 'linear' than what actually happened. Remember those 'tweaks' used to fix the message in the previous section? I hadn't quite figured that out yet..

So roughly seven NACKs later - each time troubleshooting and then fixing a different issues - we did indeed, see an ACK! The message was successfully processed by all systems, passed target system validation rules, passed sanctions and AML screening, passed SWIFTNet validation rules, and SWIFT’s regional processor had received the message and sent an 'Acknowledgement of receipt' response to the sending institution!

For the sake of completeness, I’ve included the ACK below:

And of course a breakdown of what it all means:

NameValueContextBasic Header Flag1Block 1Application TypeFF = FIN ApplicationMessage Type2121 = ACKInstitution CodeEBNKGB20AXXXEBNKGB20 (BIC) A (Logical Terminal) XXX (Branch)Sequence and Session No.19473923441947 (Sequence No.) 392344 (Session No.)Date Tag177200103 (Date) 1102 (Time)Accept / Reject Tag4510 = Accepted by SWIFTNet

Excellent! WooHoo! It worked! .. That took a lot of time and effort!

Closer Inspection

But the ACK wasn't enough, I wanted to make sure I understood what had happened to the message throughout its life-cycle. From the message I placed on the initial queue, to being processed by SWIFTNet.

Thankfully, as we sent the message back to the target institution we could see its entire message history. I already knew what the raw message placed on the queue looked like, so I wanted to focus on what became of the message once it had been processed by SAA:

The end-to-end tracking UUID had been generated and added (b42857ce-3931-49bf-ba34-16dd7a0c929f) in block 3;

The message trailer had been added ((5:(TNG:))) where I could see that - due to the BIC code used - SAA had flagged the message as 'test and training'.

Additionally, an initial System Block segment had been added ((S:(SPD:))), tagging the message as a possible duplicate. I wonder why - *cough* 7th attempt *cough*?

OK, so that was SAA. Now let’s see how it looked it once it passed through the Gateway and regional processor:

OK, we can see a few changes now.

The session and sequence numbers have been populated (1947392344);

The I/O identifier in block 2 has been updated to track that it is now an 'Output' message;

The additional data within Block 2 is a combination of the input time, date, BIC, session and sequence numbers, output date/time, and priority;

The trailer has been updated with a message authentication code (MAC) calculated based on the entire contents of the message using a pre-shared key and a secret algorithm;

Additionally, a checksum of the message body has been stored within the trailer’s “CHK” tag. This is used by the network to ensure message integrity.

I also took a look at the entire outbound message history, just to see all the “Success” and “No violation” statements to make it feel even more awesome!

So that's that really..

With a bit of research and support I was able to demonstrate a PoC for introducing a fraudulent payment message to move funds from one account to another, by manually forging a raw SWIFT MT103 single customer credit transfer message, and leveraging various system trust relationships to do a lot of the hard work for me! https://arfox158.tumblr.com/post/655263262721638400/wireless-external-hard-drive-for-mac.

As mentioned briefly in the introduction, this is not something I have really seen or heard of happening in practice or in the 'wild'. Perhaps because it clearly takes a lot of work.. and there is a huge margin for error. However, if an adversary has spent enough time inside your network and has had access to the right documentation and resources, this may be a viable attack vector. It definitely has its benefits:

No need to compromise multiple payment operators;

No requirement to compromise - or establish a foothold within - the SWIFT Secure Zone;

No requirement to bypass MFA and gain credentials for a messaging interface;

No generation of application user activity logs;

No payment application login alerts;

No bespoke app-specific and tailored malware;

And all the other things associated with the complex task of gaining and leveraging payment operator access.

All an attacker may need to do is compromise one specific user on the corporate network: a Message Queue administrator.

The industry is spending a lot of time and effort focused on securing their payment systems, applications, processes, and users to keep - among other things - payment operators safe, Messaging Interfaces locked down, and SWIFT systems isolated. But the reality is,; the most valuable and most powerful individual in the entire model, might just be a single administrator!

As always, a security model is only as strong as its weakest link. If you're not applying the same level of security to your wider institution, there may very well be many weak links within the wider network which chain together and lead to the comrpomise of systems which feed into your various payment environment.

I think the main thing to remember when reflecting on this research is that it did not abuse any vulnerabilities within the target institution's systems, or even vulnerabilities or weaknesses within the design of their architecture. It simply leverages the legitimate user access of the Message Queue administrators and the trust relationships that exist by design within these types of large-scale payment processing systems.

So the harsh reality is, there is no particular list of recommendations for preventing this type of attack in itself. However, the main point to drive home is that you must ensure the security of your users - and overall organisation - is of a high enough standard to protect your highest privileged users from being compromised. Things such as:

Strong monitoring and alerting controls for anomalous behaviour;

Requirements for Multi-Factor authentication for access to critical infrastructure;

Segregation of critical infrastructure from the wider general IT network;

Strong password policies;

Well rehearsed incident detection and incident response policies and procedures;

Frequent high-quality security awareness training of staff;

Secure Software Development training for your developers;

Routine technical security assessments of all critical systems and components;

The use of 3rd party software from reputable and trusted vendors;

However, in the context of Message Queues, there is one particular control which I think is extremely valuable: The implementation of channel specific message signing! This, as demonstrated by SWIFT's LAU control, is a good way in which to ensure the authenticity of a message.

As discussed, LAU is - as far as I know at the time of writing - a SWIFT product / message partner specific control. However it's concept is universal and could be implemented in many forms, two of which are:

Update your in-house application's to support message signing, natively;

Develop a middleware component which performs message signing on each system, locally.

This is a complex requirement as it requires considerable effort on the client’s behalf to implement either approach. However, SWIFT provides guidance within their Alliance Access Developers guide on how to implement LAU in Java, Objective C, Scala and Swift;

Strip any S block from the FIN message input. Keep only blocks 1: through 5;

Use the FIN message input as a binary value (unsigned char in C language, byte in Java). The FIN message input must be coded in the ASCII character set;

Combine the left LAU key and the right LAU key as one string. The merged LAU key must be used as a binary value (unsigned char in C language, byte in Java). The merged LAU key must be coded in the ASCII character set;

Call a HMAC256 routine to compute the hash value. The hash value must also be treated as a binary value (unsigned char in C language, byte in Java). The HMAC size is 32 bytes;

Convert the HMAC binary values to uppercase hexadecimal printable characters.

An example of how this may work in the more flexible middleware solution proposed is where the original service is no longer exposed to the network, and is altered to only communicate directly with the custom 'LAU-eqsue' service on its local host. This service would then sign and route the message to its respective queue.

When received, the core of the recipient payment service would seek to retrieve its messages from the queues via the 'LAU-esque' signing middleware, which would retrieve the message and subsequently verify its origin and authenticity by re-calculating the signature using their shared (secret) keys. Key-pairs could further be unique per message flow. This design could allow for the signing to be used as a way to validate the origin of a message even if it had passed through multiple (local) intermediary systems.

As a final bit of creative effort, I made yet another diagram to represent what this could perhaps look like - if life was as easy as a diagram:

If you made it this far thanks for reading all.. ~6k words!? I hope you found some of them interesting and maybe learned a thing or two!

I'd like express our gratitude to the institution who facilitated this research, as well as specifically to the various SMEs within that institution who gave their valuable time to support it throughout.

Fineksus - SWIFT Standard Changes 2019

https://fineksus.com/swift-mt-standard-changes-2019/

Paiementor - SWIFT MT Message Structure Blocks 1 to 5

https://www.paiementor.com/swift-mt-message-structure-blocks-1-to-5/

SEPA for corporates - The Difference between a SWIFT ACK and SWIFT NACK

https://www.sepaforcorporates.com/swift-for-corporates/quick-guide-swift-mt101-format/

SEPA for corporates - Explained: SWIFT gpi UETR – Unique End-to-End Transaction Reference

https://www.sepaforcorporates.com/swift-for-corporates/explained-swift-gpi-uetr-unique-end-to-end-transaction-reference/

M DIBA - LAU for SWIFT Message Partners

https://www.linkedin.com/pulse/lau-swift-message-partners-mohammad-diba-1/

Prowide - About SWIFT

https://www.prowidesoftware.com/about-SWIFT.jsp

5m Mathmrs. Mac's Messages For Her

Microsoft - SWIFT Schemas

https://docs.microsoft.com/en-us/biztalk/adapters-and-accelerators/accelerator-swift/swift-schemas

SWIFT FIN Guru - SWIFT message block structure

http://www.swiftfinguru.com/2017/02/swift-message-block-structure.html

2 notes · View notes

skgway · 4 years ago

Text

1818 Sept., Thurs. 24

12 1/2

A kiss last night – Sat a little while this morning in Mrs. B– [Best]’s room – Wrote 2 ½ hurried pages to M– [Mariana] (Lawton) – Said of Miss V– [Vallance]

“It did not strike me, till the receipt of your last that Eliza must have seen Miss Vallance at Geneva – She is certainly not handsome, but I should say very amiable, and very obliging” –

I[sabella] N[orcliffe] rode with Mr. Jollyffe, and took my letter to Malton in time for to-day’s post – One and a half hours tête-à-tête with Miss Vallance in her room. Hinted my suspicions as to the state of her heart and that her delicate state of health was owing to mental uneasiness.

Told her she ought to make the best of things. That I wished I could say anything to do her good for I felt too much interested about her to bear to see her unhappy. She talked a great deal of the peculiarity of her situation. That the object of her regard had proved himself unworthy of her and she was now quite convinced of it and felt reconciled on that subject. But she had done much to offend her father and was afraid that after what had passed he did not place the confidence in her which she now de[se]rved –

Sauntered about a little while with Mrs. B– [Best], and then took a couple of turns round the garden with Charlotte and Miss V– [Vallance]. Tib told me the story of Mr. Frank Best being obliged to give up his mistress that he kept in York. The archbishop sent for him a little while ago and after saying how sorry he was and behaving very handsomely, said he had had no less than 13 anonymous letters on the subject, and was obliged by his office to inquire into it.

Frank acknowledged the truth. The archbishop said he must give her up, but hoped he would not leave her quite unprovided for. Certainly not, said Frank, and gave his honour never to have any farther intercourse with her again. Immediately after this as Jollyffe told us Frank in dismally low spirits (for he was fond of the woman). Sent for Jollyffe to dine with him and told him the whole story. Jollyffe heard and compassionated, but recommended their drinking a bottle of wine together and bade him be comforted. I understand however the parson has not yet quite recovered himself –

Mr. Norcliffe a little indisposed today with pain in his right side – Very fine day –

[Miss Vallance's fiance is later revealed to be Captain Thomas Fuller Harnett. Other entries mentioning him are here, and you can read more about his fate below]

A notice of his execution from the Morning Post on 6 Dec. 1820 describes Harnett meeting his fate with resignation, and includes a copy of a letter he sent Mr. Brown the jailer.

“Mr. Harnett appeared, leaning on the arm of a friend, who we understood to be an officer... principally respecting the deaths of his brothers, when Harnett observed emphatically, “They are gone to glory; perhaps not to well prepared myself.”

The Cambridge Chronicle and Journal from 8 Dec. 1820 hints at his troubled past, and describes a gathering of a “great crowd” though not one of “due sense of the dreadful scene” of the executions.

“The most powerful interest was made for Captain Thomas Fuller Harnett who formerly maintained a respectable character in his Majesty’s service – Among others who exercised their high influence in his behalf, were the Duke of Wellington and the Duke of Richmond. Strict justice however, made it impossible to listen to their intreaties, and his fate was decided. His crime was that of forging a check on Cox and Greenwood for 20l. We lament to add, that his career, for the last few years, had been extremely dissipated. At the age of 21, he came into a property of 1,500l. a year, all of which he wasted in extravagance, and was at length driven in an unlucky hour, for the supply of his temporary wants, to commit the act, which led to his ignominious death – He expressed himself perfectly resigned to his fate, and said that he should die as he became a man. To the last he maintained as much firmness as his extreme indisposition could permit…

Harnett, whose connections are of great respectability, was attended by an officer of high standing in the army, who appeared to interest himself very much to console the unfortunate gentleman on the trying occasion. The crowd assembled was immense: we regret we cannot add, that their conduct was characterised by a due of sense of the dreadful scene.”

The 11 Dec. edition of the Morning Post published a letter regarding “The Late Unfortunate Mr. Harnett” that outlines even further attempts from his highly influential connections to spare his life, and a letter delivered to the King which contained biographical details about his life.

He enlisted in the army as an ensign at age 15, and served “for many years with credit and respectability,” becoming a Lieutenant and then a Captain. After both of his parents had died, he received a large inheritance at age 21 and left the army in 1814. He quickly squandered that money, and ended up in debtor’s prison from Oct. 1814 to Jan. 1820, when he was discharged under the Insolvent Act when "a kind hearted Solicitor, Mr. Easton" paid to get Harnett released, "incurring a very considerable expense, not one shilling whereof has been refunded by Harnett's relatives". He said at his trial in 1820 that while in prison he had broken a blood vessel circa 1818 and was given laudanum, to which he then got addicted. Once out of prison, without money and suffering addiction, he then forged the cheque for which he was arrested on 11 August 1820 at The Old Bull and Bush, Hampstead, London.

Had he succeeded in obtaining change from the forged bill, an account in the Annual Register for 1820 states he intended to flee to Ireland, and was originally thought to require support via scaffolding for his execution.Upon his arrest, Officer Humphry’s said he exclaimed, "Good God! I am undone. It is all my friends' fault that they did not relieve me," swore at his servant, and sent him for water to mix with some laudanum. Eventually he admitted it was all his own doings, that his servant had nothing to do in it, and he must suffer.

The son of Thomas Thompson the linen-draper testified against Harnett as well as the clerk to Messrs. Greenwood, Cox and Co., George Wyett, who said he didn’t recognize the bill as matching Lieut. Col. Gordon’s handwriting. The full proceedings of his trial on 18 Sept. 1820 can be read in the Old Bailey (London’s Central Criminal Court) records, here.

#anne lister #anne lister code breaker #frank best #isabella norcliffe #mary vallance #mary best #Langton Hall 1818

5 notes · View notes

if-you-fan-a-fire · 2 years ago

Text

"SENTENCED TO THREE YEARS." Edmonton Bulletin. March 7, 1913. Page 7. --- Three years at the Alberta penitentlary was the sentence meted to Gustav Blanc at the district court terday, the charge against him being the forgery of cheques on the Merchants Bank. The course of justice had been swift. It was only last Saturday that Blanc was arrested at the Hotel Alexandra in Calgary, and he arrived in Edmonton with Detective Captain Simpson on Monday night.

Of Blanc's history practically nothing is known except that for the past year he has been passing to and fro between Edmonton and construction camps in the north, with which he carried on the business of bootlegging, and earning the reputation of a good fellow, was enabled to secure information as to the method by which camp employes were paid by cheque, and also as to the banks where the cheques were cashed. While in Edmonton he passed as a real estate agent and the few friends he had were among real estate salesmen in a small way. He was always somewhat of a mystery, it is stated, not one of his personal friends, while in Edmonton, appearing to know where he roomed.

#edmonton #forgery #forger #passing forged cheques #merchant bank #work camp #bootlegging #fraud artist #sentenced to the penitentiary #alberta penitentiary #crime and punishment in canada #history of crime and punishment in canada

1 note · View note

isaiahwrites · 5 years ago

Text

We matter.

It’s been a long time, since I’ve brought myself to type anything/write anything.. any of that.. years. There is a lot going on in the world right now and I don’t even know where to start, this piece is going to cater to a specific group of people, my people.

In the last week alone, there have been 3 shootings I believe in the GTA, 3 days in a row, all leaving someone slain.. and south of the border a police officer murdered a harmless black man, suffocating him by forcibly pressing his knee on his neck until the point of passing. A forged cheque resulted in being held down by 4 officers to his point of death, please tell me, why ? An unarmed and harmless man was dealt with in such animosity? Why ? It doesn’t make sense to me and it never will. George Floyd, Dimarjio Jenkins, and others slain in this past week. May you rest in peace, and may your souls live on forever.

A few months ago, Ahmaud Arbery was out for a jog and was stopped and murdered by two white men, FOR NO REASON, what is causing fear about a man jogging, minding his business, there is nothing about that, that poses as a threat. Make it make sense. Please cause I don’t understand.

For years and years, harmless black men and women have been murdered for NOTHING. Whether their leaving a 7/11 with an Arizona and Skittles, playing loud music, vibing out with your friends on new years eve, leaving a convenience store minding their own business, being choked to death after proclaiming multiple times that they can’t breathe... and the list goes on. It’s extensive. Once again, why?

Why does this keep on happening? I don’t get it anymore. Our skin colour is not a weapon, it is not something that one should fear, so stop treating us in that manner. When will it end ? I am tired, constant loss of my brothers and my sisters, it’s draining. I don’t know any of these people and the pain is piercing as if they were my blood, cause in reality, we are all connected in someway to our brothers and sisters. The pain is universal. We all feel it.

In the movie the hate you give, Khalil, is pulled over by a cop, as he follows order to leave the car and such, he reaches in his car to get his HAIRBRUSH, and the officer mistakes the brush for a weapon and opens fire, murdering Khalil to only realize as he walks up to the deceased body that there was no weapon in sight and that it was a hairbrush in his hands. What’s crazy about this is not only the murder, but the fact that Khalil and I share the same name, that could be me, and it scares me, because the person meant to protect me can be the one that takes my life. It brings a weird reality to your life. At that point you come to terms with the sad fact that the only one that will protect you is God.

When you look at all of these cases, more times than not, the murderer walks off free of charge, or gets a little slap on the wrist. That is beyond twisted to me. How ? Why does the judicial system continue to spit in our face and add alcohol to the open wound ? WE ARE HERE AND WE MATTER. You can NOT overlook us, you won’t. There have been too many peaceful protests that have resulted in no response, these riots are what you caused and a Jamaican proverb goes as such “WHO DON’T HEAR MUSS FEEL.” WE ARE TIRED, WE ARE DRAINED, WE MATTER.

I don’t believe all police officers are bad people, I don’t believe all white people are bad people as well. I do not group. In this current situation those people have a lot of power, and their voice carries weight more than ours. If they choose to stay silent through these times, that is very telling, you can’t thirst to say nigga, but be silent when niggas are dying. It doesn’t work like that. You’re just as bad as the rotten officers and crooked people if you carry on like nothing is happening WHEN IT IS.

It is not in me to have hate in my heart, I was not raised that way. I will not let the pain others have caused, make me resent innocent people.

What you’re going to stop doing though, is saying “ALL LIVES MATTER” No. Jesus in Luke 15 states that, 100 sheep go missing. Jesus leaves the 99 and goes after one, the 99 sheep wonder about themselves and if they matter, yes the 99 sheep matter but they’re not in danger, the one sheep is” White people, Spanish, Brown, and etc are not being killed every day, oppressed on a constant basis, and being treated as if their worth nothing. So shut up and stop being selfish, cause when we say black lives matter , were not saying you don’t, we’re saying “WE ARE HERE TOO.”

I work in the education system, as a child and youth worker, being the only black man working in the building. I have had countless conversations with my black students, shed tears, laughed, and more with my kids. I let them know their worth every second I get. The beauty and strength that is their skin. I make sure they’re aware of who they are, and the power they posses no matter the age. “I’m not saying I’m going to change the world, but I guarantee you that I will spark the brain, that will change the world.”

I have faith that the future will be better, but that is also depending on the work we are willing to put in, and the impact that we want to create. We need to spread love to our black sisters and brothers. We are strong, we are passionate, we are beautiful, we are loving, we are powerful, we are resilient, we are not going to ever show weakness, we may be down but we are not ever going to be out. WE ARE HERE AND WE MATTER.

Peace and Love,

Isaiah.

7 notes · View notes

whynotwriting · 5 years ago

Text

A travelling jeweller

This is a short story I wrote from a prompt some time ago. I’m not sure where I intended to go from this, but I quite like it. I hope you enjoy!

________________________________________________________________

The town of Moreunder is known for one thing. It is, and always has been, where those who want to be forgotten go. For as long as anyone can remember, the place has had a reputation for depravity, the dregs of the earth descending on the place daily, the law enforcement agencies too afraid to follow. It was a sanctuary. Now… things have changed.

Change arrived on a cart. The man was different, anyone could see that. Tall, lean, with an almost grey pallor to his skin, he carried nothing but a small cloth bag. That in itself was not unusual. Many arrived with only the clothes on their back, and often those were gone within the first few days. It was a nest of criminals, after all. But even so, there was definitely something different to him. Not wrong. Just… odd, as though he wasn’t fully there.

Like most who enter Moreunder, his first stop was the tavern. He didn’t join in the gambling. Didn’t buy a drink. Instead, he sat alone at a table as far from the bar as possible. Eyes watched him curiously, but no-one approached him. When the lights went out, he simply smiled.

Two minutes later, when they flickered back on, his seat was empty. On the table, in front of his seat, a silver locket gleamed.

Initially his absence wasn’t noticed - everyone was too busy proving to the rest that they hadn’t been scared, hadn’t worried for a moment. Slowly, though, the realisation spread. He was gone. And no-one had heard or felt him go.

Eventually curiosity overcame fear, which even the hardened men and women of Moreunder still felt. After so many years on the run, for many of them fear wasn’t an emotion anymore: it was a necessity. Survival depended on it. Even so, a silver locket, shining new, was tempting. It was a particularly tough brute named Red Jack who picked it up.

What happened next is still told in the bar to this day, by those who are still there, as well as those who only wished it. Locket in hand, Jack held it high, a grin on his face, dangling it by the chain in front of the faces of those shorter than he. Then he snatched it back into his palm and, with a deft flick of a finger, opened the latch.

His face went white. His hands trembled. His mouth fell open in a moan, his eyes widened to twice their normal squint. Crushing it closed into a fist, he dashed out the door and into the night.

Though many of the pub’s other patrons tried to follow his mad rush, he vanished absolutely. He was not seen again. His clothes, but not the locket, were found abandoned on the edge of a swamp several miles from the edge of town.

The stranger, however, was seen again. Three months passed before his next appearance. And it was like he never left. The landlord opened the door to the tavern one morning to find his, dressed in the same clothes, sat in the same seat. When he asked how he’d got in, all the response he got was a sad smile and a small shake of the head.

A place like Moreunder doesn’t have police. It wouldn’t work. Criminals would never accept something like that. What there was, on the other hand, was a militia, basically a collection of the biggest bads the town had. Now, the landlord would normally not associate with the Militia, but he was scared. He’d fled to Moreunder after a misunderstanding about the amount of forged cheques he’d been submitting to banks. His bar had good locks. Good doors and windows. In a town of thieves and burglars, it wasn’t a choice. He needed help.

An hour later he returned, four of the low level Militia members with him. By now, the story of the night in the bar was legend, but the Militia were respected. They had a job to do, and they would do it. Never mind the phantom who could seemingly walk through walls.

“Oi!” one greeted the stranger. “How’d you get in here?”

Once again, the only response was a smile and a slight head movement.

“Oi! Goblin! We’re talking to you!”

The man turned his head slightly to look the Militia member in the eye. Again, he shook his head.

“Look,” the henchman said to the bartender, “what do you want us to do about him? He taken anything?”

“Well… no. But…”

“Then he’s not done anything, so we can’t do anything, though I’d love to shank the smug bastard.”

“But… my pub!”

“Yes?”

“He’ll scare the customers!”

“So ask him to leave!”

“You think he will?”

“You haven’t tried, have you? Worth a go, right? And if he don’t, then we can do something.”

“Fine. Could you please leave?”

Without a word the man stood, brushed down his clothes and walked out the door. The five of them staring after him in disbelief.

“Well, I’ve seen some strange things in my time here, but he takes the biscuit. Anyway, our job’s done. Come on, fellas.”

The Militia had their headquarters next to the casino. After all, criminals had money, or at least to begin with they did. A few days in the casino normally solved that problem, and that was after the Militia had banned the card sharks and card-counters. It was a large building, not as flashy as the casino it backed onto perhaps, but built like a fortress. The members filed their reports and left, phones in pockets awaiting another call. They didn’t have long to wait.

Barely two minutes had passed before the leader of the small group felt his pocket vibrating. The device said no caller ID. That was normal. That was expected. When he answered it, however, he found only white noise on the other end. Scowling, he ended the call and put the phone back in his pocket.

As he went to withdraw his hand, he felt his fingers brush something cold. He groped for it and came out with a ring, gold, with a small emerald set in the end. The workmanship was exquisite and he found himself turning it in the sunlight, admiring the way the metal and jewel reflected the rays. Smiling, he slid it onto a finger.

The others could never agree quite what happened. Did his face sag, the skin drooping, then snapping back into a terrifying smile? Did his eyes roll back in their sockets, foam spill from his open mouth? Did his legs give way, spasms racking his body as he writhed in the dirt? To those watching, any and all of them could have been the case. What they all agreed on was that they ran for their lives, glancing back only briefly in their terror.

When they returned, some hours later, he was gone. There was a pile of clothes slumped on the pavement. This time, however, there was a photo. A Polaroid, faded to almost white. It showed a woman, and a child. In the background, skyscrapers could vaguely be seen against a washed out sky. Nothing else could be seen.

They took the clothes into the Militia HQ, and tried to explain what had happened. Naturally, they weren’t believed. That is until they showed the photo. Then the man behind the desk grew interested.

“Wait, you said it was Rufus? You mean Butcher?”

“Yeah, that’s him. Why?”

“Well, I caught a glimpse of him taking a photo out of his pocket once. He threatened to stab me if I ever told anyone. If he’s left it here for some reason…”

“Should we tell the high-ups?”

“I don’t think we have a choice.”

A call later and the three of them were headed upstairs. The door to the office was open. Sitting inside was a familiar man, and the leader of the Militia. They were beckoned in. Hesitantly, they entered.

The man with the grey face turned his head at their approach and smiled. He gestured towards the empty seats at the table. Gingerly they sat down, as though afraid the chairs might explode. It was only then that they noticed the leader of the Militia wasn’t moving. Not a muscle.

Though sat upright, his face was frozen in an expression of shock. On his wrist was an elegant gold bracelet, carved like the great serpent Ouroboros. On his brow rested a crown of platinum, each spike a prancing horse. A signet ring displaying the head of a lion adorned his finger, and a thin chain leading to an hourglass medallion, carved from what seemed to be diamond, hung from his throat. He would have been an impressive sight, were it not for the face. And the hands. Oh the hands.

Somehow the hands were worse than the face. On the face was only shock, albeit pop-eyed, terrified, paralysis-inducing shock. The hands had twisted, trying to grab at the crown, the ring, the medallion, the bracelet all at once. Each finger was curled in directions that shouldn’t be possible, and the palms were splayed towards the grey man as though to ward him off.

Now, for the first time, the man spoke.

“You need not fear me. I will not harm you. I have found the one I came for. The others… Well, some things can’t be helped. In a few minutes you will leave this room. You will never see me again, never hear of me again. The same is true of your master. He will not be returning.”

“You-you-you can’t just… take him!”

“That is precisely what I can do. Unless you’d like to take his place.”

The man leapt to his feet, backing away from the table.

“No no no no no no no. Don’t you come near me. I am not having any of your voodoo crap. Stay away!”

He drew a gun. The stranger blinked at him, clearly unperturbed. Then, in one smooth motion, he lifted a hand and threw a shining object at the man. Instinctively he dropped the gun and caught it. He stared down at the shining coin in his hand and screamed. Still clutching it, the skin on his knuckles white from gripping it, he fled from the room.

“Anyone else? I don’t enjoy this, you know. All I’m asking is a chance to explain. That’s all.”

The other two, wide eyed, nodded furiously.

“Good. This town should not exist. Not criminals banding together for safety: that’s normal. No, I mean probability wise. I mean space and time. Of course, you won’t understand any of this. Put simply, I fix things. And I make things. I guess I’m a jeweller. That’s the simple way of putting it. A travelling jeweller. And I would like to give you a present, as proof. Don’t worry. It won’t… affect you. It is, for once, just a jewel.”

Neither man looked happy, but they had seen what happened when the other man had tried to run. Reluctantly they accepted.

The stranger drew from his pocket two small shining gems. He placed one in front of each man. One was black, the other white. When they picked them up they were curiously heavy, each seemingly feather light and mountain heavy at once. The stranger stood and thanked them, then gestured to the door. They left, doing their best not to break into a run.

#drabble #prompt writing #my writing #travelling jeweller

5 notes · View notes

dr-jekylll-and-mr-hyde · 5 years ago

Text

Chapter 1: Story of the Door

so we are introduced to Mr. Utterson, a lawyer

this dude is known for being nice to people but not really having many friends?

like it takes a long time for him to make friends, so most of the ones he has are either family or people he’s known for a really long time

he's got this one friend, though (no one can really figure out why they’re friends)

his name’s Mr. Enfield, and he, too, is not very interesting

the two spend a lot of time going on ~Sunday Strolls~

so they’re out on one of these strolls, when they pass by this weird building that no one seems to live in (because it’s all run down)

and Enfield is all “that door is strange, but what’s stranger is the strange story it reminds me of”

and Utterson is all “oh do tell”

so Enfield tells him about how, like a week earlier, he was walking down that same street (seriously does this man do anything but stroll down this street)

when he was this dude just run over this little girl

like they ran into eachother and he just... walked over her

so anyway our hero Enfield stops the guy, and is immediately freaked out by the guy’s face

there’s nothing wrong with the guy’s face, but he’s freaked out and almost overwhelmed by the desire to just kill this dude

by now the girl’s family is there, as is the doctor they called

and Enfield can tell everyone has the same desire to just murder this man

but none of them do, and they threaten mystery child-destroyer into coughing up 100 pounds

and he’s just like... ok

so he goes into the mystery house mentioned earlier

and he comes back with some gold and a cheque

Enfield looks at the cheque and is like... is this yours because i don’t think it is

and mean-guy just goes ‘yup it’s mine. i’ll even go to the bank with you in the morning to be sure’

so the bad-man, Enfield, the doctor, and the girl’s father all go to Enfield’s apartment to spend the night

and then they go to the bank and what do you know? the cheque is real and not forged like Enfield thought

“‘Tut-Tut,’ said Mr. Utterson.” (a real quote from the book, very important)

so Mr. Utterson and Mr. Enfield argue about the house for a moment, and they agree that someone probably lives there, seeing as smoke comes from the chimney

but they both think it’s a bit weird

they agree not to ask too many questions about the house

Mr. Enfield reveals the cheque was from a guy called Mr. Hyde

then they agree to not talk about it anymore

and they shake on it

that’s the end of the first chapter

#the strange case of dr Jekyll and mr Hyde #jekyll and hyde #i don't know what else to tag #so this is just me processing the chapter in text form

2 notes · View notes

sydneysageivashkov · 6 years ago

Text

Spun Her Around On The Damp Old Stones

Captain America had done his duty. Steve Rogers still had a life to live.

AO3 | ff.net

Steve could never say when he’d first thought of it.

Maybe it had been when he saw Peggy in her office, looking so beautiful and competent that it made Steve’s heart hurt. Maybe it was when Bucky said, “I’ll miss you, pal,” like he already knew. Maybe it was as he returned the soul stone and stared into the withered, tired face of the embodiment of evil. Maybe it was as he stared down at the Pym Particles, ready to return to 2023.

Maybe it was all of them. It didn’t matter when, exactly, he’d had the thought. What mattered was that he materialised into existence in Brooklyn, 1947, on a cool, autumn afternoon, red and orange leaves blowing through the street around him.

Captain America had done his duty. Steve Rogers still had a life to live.

He found Peggy in an automat. Steve spotted her entirely by accident, just happening to glance in the window as he passed. She was chatting to a waitress, smiling in a way that reached her eyes. He took a deep breath, opened the door, and stepped inside.

The bell over the door rang, and Peggy glanced up – a spy’s instinct, he thought, because he had never known Natasha, Clint or Fury to not glance up at an opened door. Peggy froze, the fork dropping from her hand. The waitress looked up at Peggy’s reaction, and her mouth dropped open.

He knelt down next to her chair, looking up at her still-frozen expression. Very gently, he took her hand. “I’m so sorry I’m late.”

Peggy’s lip trembled. “You couldn’t call your ride?”

Steve huffed out a laugh, half torn between genuine laughter and tears. “I couldn’t call my ride,” he agreed.

She brushed her free hand against his cheek tentatively, almost slumping in relief as her fingers touched his face. “Howard told me he stopped,” she said. “If I’d known, I would have come, I would have…”

“It wasn’t Howard,” he said. “It’s a long story, Peggy. God, it’s the longest story.” Natasha. Tony. Sam and Bucky, Wanda and Clint, Rhodey and Nebula and Rocket and Carol and Okoye.

Without taking her eyes off him, Peggy said with deliberate calmness, “Angie, I’m going to need the bill, now.”

“Uh, yeah. Yeah, of course,” said the waitress, glancing between them. She shuffled off and returned only a moment later, handing Peggy the cheque and hissing, “You’ve been holding out on me, English.”

“Sorry, Angie,” said Peggy, rather unapologetically.

Angie grinned, her eyes bright and laughing. “Sure you are, English. You get going with lover boy here, and I’ll see you later.”

“See you later,” repeated Peggy, and dragged Steve up and out of the automat.

“Are you going to tell me your story?” asked Peggy, her head resting on his chest and tracing her fingers along his stomach absent-mindedly.

He barely even knew where to begin. “I’m not the Steve that went down with the Valkyrie, Peggy. It’s been years.”

Peggy’s fingers paused on his stomach. She propped herself up on her elbow so she could look down at him, dark hair falling around her head. “How long?”

“Eleven years,” he admitted.

She flopped back down on to the bed. “Bloody hell, Steve.”

“They found me in 2012,” he said. “They defrosted me and put me to work leading the Avengers against threats that the regular military couldn’t contain. It was only a few days ago that I even had the ability to come back to you.”

“They have time travel in the future?” asked Peggy, raising her eyebrows.

“It’s a very recent thing,” said Steve. “Almost impossible.”

Peggy’s hand found his, and he intertwined his fingers with hers, clinging on with everything he had.

“Howard had a son,” he said. “Tony. Probably cleverer than Howard, honestly. He was the one who worked it out. He was the one who…”

Peggy squeezed his hand when he couldn’t finish. “You had a life there. Friends.”

He nodded, swallowing. If he closed his eyes, he could see Natasha, still, saying that he was her family. He could see Tony, carrying his daughter in his arms. Sam and Wanda and Thor and T’Challa. “They were good people, Peggy.”

“If they were your friends, they would be,” said Peggy. She pushed herself back up and looked down at him, curls askew and her face soft. “You can tell me about them, if you want.”

“Natasha was one of the first people I met in the twenty-first century,” said Steve, his heart constricting a little. “If you’d asked me at the time, I don’t think I would have guessed she would be one of my best friends, but…”

They agreed to keep his return quiet. They reached out to the Howlers, to Howard, to Bucky’s sisters. Only Peggy knew about his eleven years in the future. Peggy and Howard forged him a new identity. He grew out his beard to help cover his face, let his hair grow a little longer than he used to. But his best defence against recognition – as he’d learned from Natasha – was simply that people didn’t expect to see Captain America. So they didn’t.

In some ways, slipping back into the 1940s was as easy as breathing. Sometimes, though, it was like a filter had been placed over his eyes, so everything was just the slightest bit different.

Sometimes, he hummed Hamilton songs under his breath, and the people around him questioned what genre he was singing. Sometimes, a joke or pop-culture reference slipped out that made sense in the twenty-first but earned him blank stares in the twentieth.

Sometimes, it was worse. The Civil Rights Movement was slowly beginning to pick up steam – but with it came the rebirth of the KKK. The eugenics movement might have been discredited by the revelation of the Holocaust, but the racist sentiments that caused it hadn’t dissipated. It wouldn’t be long before the women’s liberation movement began, but Peggy still seethed at the misogyny of her colleagues.

“Does it get better?” asked Peggy after one long day. She was collapsed on their sofa, her legs lying across Steve’s lap.

“Slowly,” he said. “There are setbacks and bumps in the road, but there’s progress, Peg.”

“Were you still fighting the good fight?” she asked, nudging him with her foot.

“Hell yeah,” he said. “I scandalised so many conservatives, Peggy. Tony Stark almost had an aneurysm, he laughed so hard the first time I went on Fox News.”

Peggy sighed. “I just wish they’d hurry up about it all.”

Steve took her hand and rubbed gentle circles with his thumb. “You deserve so much more than what they’re giving you.”

Peggy sat up, placing her hand on his cheek and smiling at him softly. “I know. Thompson’s lucky I haven’t murdered him already. I think you keeping me sane is the only reason I haven’t.”

Steve snorted. “I’m pretty sure the only reason I haven’t murdered Thompson is because of you keeping me sane.”

Peggy laughed, shifting so that she could rest against his shoulder. He pressed a kiss to her hair. “We are a pair, aren’t we? I do believe we’ve given Mr Jarvis grey hairs.”

“Oh, no, those grey hairs are all on you,” said Steve, elbowing her. “He had them all well before I came back.”

They name their eldest child Natasha Colleen Carter, their second Michael James, and their third – another girl – Samantha Wanda. Peggy was the first to suggest Natasha Colleen, and he had stared at her, wide-eyed.

“What?” she asked, a hint of laughter in her voice. “I thought you’d appreciate the name.”

“I do,” he said, slowly. “But… I met Natasha. At your funeral. She was…”

Peggy laughed outright at that. “Oh, darling,” she said. “Did you really think my children were from anyone else, at this point?”

Steve opened and closed his mouth several times before saying, “I suppose I hadn’t really thought about it.”

She patted his cheek affectionately. “I think you’ve been a little dense, my darling.”

“I suppose,” he said, scratching the back of his neck. “She was wonderful, Peggy. All of them were.”

“So there’s more, is there?” she asked, raising an eyebrow. “Good. This world needs more Carter-Rogers in the world. Between us, we should be able to start a revolution.”

“Ooh,” said Steve, a smile tugging at his lips. “I’m not sure the word’s ready for a Carter revolution.” Peggy laughed and kissed him on the cheek.

“We’ll make them ready,” she said. She moved her hand to rest over her stomach. “We’ll make them better.”

He told the children stories at bedtime, but not from any book.

He told them of a girl who escaped a hate that had once consumed her, who had kept the capacity to love even after so many losses, who was the strongest of all of them.

He told them of a man and a woman who had done terrible, terrible things in another person’s name, and had dedicated their lives to saving as many lives as they could in their own name.

He told them of a man who had lost his best friend to war, and had dedicated his life to bringing everyone else home from it.

He told them of a man who gave his life for the world, who could finally, finally rest.

Most of his friends thought of them as stories. It wasn’t unreasonable. While Peggy ran the world’s most secretive agency, he had taken to drawing comic books, and if his heroines had a tendency to have a hint of red in their hair, or scarlet leaking from their fingertips – well, no one was around to call him on it.

There were three children calling him Dad, now, and so many more calling him Uncle Steve. (The day that a tiny, precocious Tony Stark had called him Uncle Steve for the first time was potentially the weirdest day of Steve’s life.) He was uncle to the Howler’s kids, to Bucky’s nieces and nephews, to Tony. Once upon a time, he had told Tony that the man who wanted a family and stability had died in the ice. He hadn’t even realised he was lying at the time. Now, he watched them all – his kids, his friends’ kids, his beautiful, wonderful wife – and almost couldn’t breathe, he loved them so much.

“About enough for the Carter-Rogers revolution,” whispered Peggy into his ear at one reunion, making him snort up his beer. Peggy smiled at him innocently as Howard cackled across the room.

“Watch what you drink, Dad!” yelled Tasha, twelve-years-old and still learning how snark worked. The rest of her cousins took up the yell, good-natured jeering coming from all corners of the garden.

There were things that he hadn’t missed about the twentieth century. There were things he did miss about the twenty-first. But these kids were going to be the ones who built that century, who changed the world. Steve wouldn’t trade the world for a single one of them.

“Was there ever anyone?” murmured Peggy one night, her chin resting on his shoulder as they slowly twirled around the living room.

“Anyone?”

“Did you ever find any other dance partners?” she asked.

He leant back to he could look her in the eye. “No, Peg. I mean, they convinced me to go on a date or two occasionally, but… It’s you.” Her grasp on his hand strengthened, and he pulled her ever so slightly closer to him. “It’s always been you.”

She leant up and kissed him, soft and long and slow.

“Thank you for coming home to me,” she said as she pulled away. “It’s always been you for me, too, you know. I tried, once. Maybe it might even have worked. But Daniel… I couldn’t forget you, and neither could he.”

“I will always come home to you,” he promised. “Always.”

She pulled him down to kiss again, but just as their lips met, the door swung open and little Sammy toddled in. She looked up at them, cocking her head.

“Dance?” she asked.

Steve met Peggy’s eyes, saw the barely suppressed smile in them. “Alright, squirt,” he said, letting go of Peggy’s waist. “Let’s teach you how to dance.”

He arranged her on his toes as Peggy turned the radio on, It’s Been a Long, Long Time wafting through the air. Sammy shrieked with laughter as they danced, and above her head, Steve watched Peggy, standing so, so beautiful by the window.

It had been seventy-five years and three hundred and twelve days since Steve had heard his brother’s voice.

“Sam!”

He smiled.

#mcu #steggy #steve rogers #peggy carter #captain america #endgame spoilers #fic

61 notes · View notes