Originally Posted by
IB-Dick
We understand the flaws in md5 hashes, however everyone I've personally discussed this with has verified that the vBulletin hashing method is sufficiently secure.
If it uses MD5, it must be considered broken. This has nothing to do with vB, it is the algorithm that is at fault.
While we haven't restored the files from backup, hourly snapshots were diff'ed and we have ensured that the system is secure. This was a script kiddie script that exploited a vulnerability right after it was announced and before we had an attempt to patch.
Good to learn that you verified the system's integrity to be uncompromised (which the check against the backups did). ^
I assume that you did additional checks to verify the confidentiality of the password data?