How easily will the vBulleting data from vBulletin and Foxit be cracked? What data is at risk? How was it encryted?

Question

vBulletin Solutions and Foxit Software were breached. The culprit (ColdZer0 or Coldroot) claims to have data from 479,895 vBulletin Service and Foxit Software accounts that include identifiers, security questions and answers, and password salts and hashes.

What data was actually exposed?
How were the answers and passwords encrypted? How easy will it be to obtain the original values?

Note, a couple of years ago another vBulletin based site, MacRumors Forum, was breached. Over half of the ~860,000 salts were reported to be just 3 bits long. These were apparently older accounts that had not had a recent password change.

Answer 1

I don't have a copy of vBulletin myself to inspect, but multiple sources claim that their hashing scheme is:

md5(md5(password)+salt)

This is unfortunate seeing as md5 has some documented weaknesses, and is also a "fast" hash. Hashing processes used for passwords should be slow to make brute force attacks slow (and hopefully practically impossible).

The good(ish) news is:

a. They were hashed and not stored in plain text

b. They are salted so a plain rainbow table attack probably won't work

The main threats are brute force attacks (especially dictionary based ones).

Hashcat has been benchmarked to 8,581,000,000 md5 hashes/second on basically a regular gaming PC. Assuming that the salts were exposed in the dump, an a-z password and 2 x md5 operations are required per combination then it would take about 48 seconds to brute force an 8 character password or 9 hours for 10 characters. Dedicated cracking PCs are considerably faster, and a dictionary based attack would be much much faster again.

Unless you have a very long password and you're certain it's not going to be in a dictionary, I'd consider your password compromised. In practice, I'd consider your password compromised regardless.