Dear LFS Racers,

An update on the recent thread about a leak of LFS passwords from an unknown source.

After an LFS user admitted having a list of tens of thousands of username + password combinations, after some heated discussion on a thread that has now been removed, the user admitted he shouldn't have done this and decided to send the information, to start to put right the situation.

We are grateful for this action, after the initial disruption, this was the right thing to do.

I have started to analyse the data. I don't want to give exact figures but the user names are in the 10s of thousands.

Of these, roughly 5% are invalid (too short or too long, can't possibly be an LFS user name)

Of the possibly valid names, around 40% are not found in our database.

The other 60% are valid user names. Of these, more than 90% are DEMO and under 10% are LICENSED.

So many user names are invalid, proving that if these names come from a single source, it's not an official LFS source. I believe that people may have used their username somewhere else. Maybe in a pirate community or in some other app that required their user name.

I will do further checks on this data, but wanted to give you an update on the progress so far. Many of the licensed users will need to be contacted in some way, probably by an automated email.

I'll leave the thread closed for now as I don't really think I need more info at this point.


Changes I have made in the past few days regarding security:

- You now get a notification email if anyone logs in using your account.
- WEBpassword can only be changed via an email (like the "Forgot your password" system).
- GAMEpassword can also only be changed via an email.

So now it should be impossible for you to lose control of your account if you haven't already. Although for all the accounts we have not yet protected, if your password is known to any hackers with this data, they can obviously log in to your account and change various settings. At least you will receive an email if they do log in.


A note on security, even if it may sound repetitive:

- Please, DO NOT use a GAMEpassword that is the same as your WEBpassword
- Please, DO NOT use passwords that are the same as the passwords on any other accounts you care about
- NEVER ENTER YOUR LFS USERNAME AND PASSWORD INTO ANOTHER WEBSITE OR PROGRAM
- IF YOU HAVE EVER ENTERED YOUR USERNAME AND PASSWORD SOMEWHERE ELSE - CHANGE YOUR PASSWORDS NOW!


Thank you for reading.

Another update.

This morning I've been detecting which of the listed user names have a password that matches an LFS WEB or GAME password.

Many of the users on the hacked database aren't really LFS users. We know this as around 40% don't have a user name that matches an LFS user name. Around 60% do match an LFS user name, but even then, it's not necessarily an LFS user.

The only way to be fairly certain it really is an LFS user, is if the hacker list username+password matches an LFS username+password (WEB or GAME password). Password matches are a significant minority that we have to deal with because of the security implications. In those cases (password match) we intend to change the password and notify the user (via email) using an automated process.

But I've done a quick test to find out which countries the matching user names come from. This is from the full list of hacker list usernames that match an LFS username, including DEMO accounts.

To be clear, these numbers are too high, because they include some user names that are not really an LFS user (e.g. someone just happened to choose the same username as an LFS user). Also to be clear these are mainly DEMO accounts. I've only shown countries that have more than 100 users listed.

Looking at the numbers below, it seems most likely to me that the source is "LFS Pro" which was a pirate community and master server system based in Brazil.

I'm thinking this because Brazil itself is 2nd on the list and Portugal is 4th, which is higher than expected given the size of Portugal. In my opinion it's because of the language connection to Brazil. Also 3rd on the list is Argentina, probably due to the South American connection.

I'm not really sure why Turkey is on top. Maybe it's because LFS has always been popular in Turkey and LFS seemed expensive there, so a lot of Turks went for LFS Pro. Or possibly the list has come from two separate sources?

TR 7523
BR 3745
AR 1250
PT 1167
BG 737
LT 727
ES 693
US 677
RO 488
PL 438
IN 428
ZA 399
GB 371
HU 337
FR 323
IT 309
DE 275
SA 264
GE 262
PK 245
CZ 236
RS 224
LV 221
CL 213
CO 187
FI 181
UY 167
SE 162
NL 162
GR 150
AE 148
DZ 144
PH 142
EG 141
AU 137
CA 130
ID 125
MX 124
EE 113
DO 110
BA 108
SK 107
MA 106