Vodafon.is leak

TL;DR - Vodafon.is has been hacked since Feb 2010, xyz users email + cleartext passwords leaked, and a small amount of unencrypted creditcard data leaked.

 _______________________
|                       |
|   FILE:  users.sql    |
|_______________________|

Rows: 77227
Users with cleartext password: 2831

 _______________________
|                       |
|   FILE:  signup.sql   |
|_______________________|

Database layout:
CREATE TABLE `signup` (
  `id` int(10) unsigned NOT NULL auto_increment,
  `ssn` char(10) character set latin1 default NULL,
  `passwd` varchar(255) character set latin1 default NULL,
  `encpasswd` varchar(255) default NULL,
  `email` varchar(255) character set latin1 default NULL,
  `msisdn` varchar(255) default NULL,
  `stamped` datetime default NULL,
  `bank_key` char(128) character set latin1 default NULL,
  `bank_done` set('0','1') default '0',
  `email_key` char(128) character set latin1 default NULL,
  `email_done` set('0','1') default '0',
  `upgrade` set('0','1') default '0',
  `shortcut` set('0','1') default '0',
  `done` set('0','1') character set latin1 default '0',
  `status` tinyint(4) default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=27735 DEFAULT CHARSET=utf8;

"passwd"	: cleartype password
"encpasswd"	: bcrypt, workfactor 8 ($2a$08$)

So much for hashing, salting and stretching the passwords!
TODO: password analysis

 ____________________________
|                            |
|   FILE:  shop_order.xlsx   |
|____________________________|

Columns:
	id
	cart_id
	name
	vidtakandi
	kennitala
	address
	postcode
	email
	phone
	creditcard_type
	creditcard_name
	creditcard_number
	exp_month
	exp_year
	total_price

Rows:
	3206 (total)
	280 ("null" rows)

Most of the creditcard_number is "null", but the database does contain 2 rows with cleartext creditcard numbers + expire date, and 2 rows with what appers to be "encrypted" creditcard numbers.


 ___________________________
|                           |
|   FILE:  env_users.xlsx   |
|___________________________|

Columns:
	id
	ipaddress
	user
	pass
	email
	first_name
	last_name
	phone
	fax
	alt_phone
	reg_date
	last_active
	user_level
	notes
	image
	admin_notes

Count of rows:
	331

Everyone, but one, has a "user_level" of 0.
id		1
ipaddress	2130706433
user		admin
pass		0e2814ca720a84fa67df64c6704e6238
email		valtyrv@vodafone.is
first_name	Valt??r Bjarki Valt??sson
last_name	null
phone		null
fax		null
alt_phone	null
reg_date	1/21/2008 0:00
last_active	3/24/2009 15:40
user_level	9
notes		null
image		null
admin_notes	null

Searching for the password hash on Google only gives 2 results:

One is from md5this.com[1] and tells us that the hash was added Tue 27th Apr, 2010 07:28 am and still hasn't been cracked. The other is from password cracking site insidepro.com[2] and from a post by a user named "pvjk" who ask'd the community help to crack the hash on Thu Feb 25, 2010 1:47 am.

This guy, pvjk[3] is an old user:
Joined: 	31 Oct 2008
Usergroups:	None
Total posts: 	176
Reputation: 	35
Last post:	Thu Sep 06, 2012 6:05 am

So what so special about the hash he posted? Well, if you try to crack some of the other hashes on the list:
               hash              : plaintext
fd0fb93cb0469641418dec73a88356fb : liquids+(_a*
f4af4a693ae12edf54788e7bae215aee : 123456s+(_a*
ec5b0a570b81361d98228c1a232833e0 : viktors+(_a*

It appers that they are created with the static salt ("pepper"):  s+(_a*
$hash = MD5($password . "s+(_a*"); // this is not secure, but how vodafon did it.

So most likely the hash "0e2814ca720a84fa67df64c6704e6238" is specific to vodafon.is
And someone was trying to crack this in Feb 2010... Do I need to say more?

Well, actually I gave it a shot (simple dict + salt) and found it in less than 1 sec:
0e2814ca720a84fa67df64c6704e6238 : abcd1234s+(_a*
So the password of the admin is "abcd1234".

[1] http://www.md5this.com/list.php?page=54080&key=1&author=ToXiC&country=Cyprus&city=Nicosia (Note the "author" in the URL).
[2] http://forum.insidepro.com/viewtopic.php?t=4009&postdays=0&postorder=asc&highlight=ab882278fc5de873211f18f99b12b872&start=750&sid=78dc561dab3b2bd58d5b43cb75e6a065
[3] http://forum.insidepro.com/profile.php?mode=viewprofile&u=3160