database hacked > know users passwords

[el_capiton]

hello

if someone gains access to the vbulletin database, is it possible for the hacker to know the users pass? i mean they are in hash format could they retrieve the passwords from the hash? how long would it take to perform this task, if possible

[SEOvB]

It would take ages to perform for each individual password

[el_capiton]

Originally Posted by FRDS

It would take ages to perform for each individual password

for ages you mean days, weeks, months?
even with the salt thing i think vbulletin has in the passwords?

[phantom15]

md5 salted... to bruteforce would take years I think

[SEOvB]

Originally Posted by el_capiton

for ages you mean days, weeks, months?
even with the salt thing i think vbulletin has in the passwords?

By ages I mean, a lot longer than it'd ever be worth

[Dismounted]

There are no known rainbow table attacks for this type of hash. The only method would be to brute force, and that would take years. After brute forcing the hash, you would need to brute force the actual password's hash, which would take less time, but still time (although this time, rainbow tables are possible).

[el_capiton]

thanks for your answers

[Medtech]

Originally Posted by phantom15

md5 salted... to bruteforce would take years I think

Actually with salt and the latest dictionaries, it is done in about 20 seconds.. if the perp knows what the salt is.

Originally Posted by FRDS

It would take ages to perform for each individual password

Actually Admins are the targets, what good would it do to hack a mod or member?

You want a secure password? use 4 to 5 words with spaces and a couple symbols. That is impossible to decode for even the best hackers. I use 1024 bit encryption in my passwords.. even the feds can't decode that, lol

[Dismounted]

How about we go all out and use Whirlpool?

[el_capiton]

Originally Posted by Medtech

Actually with salt and the latest dictionaries, it is done in about 20 seconds.. if the perp knows what the salt is.



Actually Admins are the targets, what good would it do to hack a mod or member?

You want a secure password? use 4 to 5 words with spaces and a couple symbols. That is impossible to decode for even the best hackers. I use 1024 bit encryption in my passwords.. even the feds can't decode that, lol

i've a guy claiming it accessed the database and got one mod pass and logged in with it.
he has made a screenshot of mods and admin area to prove he was there.
the mod pass was 10 chars long and it was portuguese, its still easy to be discovered?