We are saving password in a database using PHP:
return hash('sha256', PASSWORD_SALT . $password);
Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin one.
The story did not ended dramatically or terribly like in Hollywood movies, because he was kind enough to point us the holes. (We "thanked" him accordingly.)
Now that the holes have been patched, we are afraid that there might be some holes somewhere else as the code base is large. The questions are:
- How on earth did he crack the password so fast (few hours to less than a day)? PASSWORD_SALT is quite long, stored in the source code and he did not have it. Also, a blank password is not accepted in the PHP code.
- We assume we should change the hash/encryption for existing and future passwords. Which encryption do you recommend so that the exposed password is more secured?
He told us that he use some software and dozen of desktop machines available to him in his company. He said he is a bored security expert in some large firm, so he has the means to do stuff.