Hacking BIOS and Windows Passwords

I'm going to do another tech post as I am totally frustrated with political economic policy development and wonder whether it is even worth my time to follow legislation and developments.

In any case, I was enjoying a beer at the local American Legion post the other day when the bartender asked if I could help with a problem with their PC. She couldn't remember the Windows password she had set so she could not use the office PC. I told her that I thought that it wasn't possible to bypass a Windows password and she would probably need to reformat the hard drive and reload Windows and all of her applications (she didn't know if she had the software) but that I would check it out. I was dead wrong. After about 30 minutes with Google, I found that not only is it possible but hacking a Windows password is incredibly easy.

There are several software applications that will hack the Windows password and tell you what the password is but the best that I found is Ophcrack. You need some advanced but basic PC skills in that you will need to be able to set the BIOS boot sequence to try to boot from the CD drive before the hard drive and will need to be able to make an ISO boot CD (takes about 2 minutes with some freeware) but beyond that you just boot from the CD and wait for Ophcrack to tell you what the Windows password(s) is.

I went to the Legion to crack the Windows password only to find that one of the people who had tried to help had set a BIOS password so back to the drawing board. I quickly found out that clearing the BIOS password is even quicker in most cases than hacking the Windows password. All you have to do is get access to the motherboard inside of the PC and move a jumper which on a Dell takes about 60 seconds. A notebook PC would be much harder only because it is more time consuming to take a notebook PC apart which is required in order to access the jumper on the motherboard. I should note that some notebook manufacturers such as Toshiba have reportedly implemented additional security to prevent clearing or hacking the BIOS password.

OK, so what are the comparative benefits of setting a BIOS versus a Windows password?

A BIOS password generally protects the PC in that the PC is not not usable if you can't get by the BIOS password. However, the data is not protected in that you can take the hard drive out of the PC and plug the hard drive into a working PC and access all of the data on the drive. Removing a hard drive from a notebook PC made in the last 6 years or so takes about 1 minute.

A Windows password generally protects your data but not your PC. If someone stole your PC which had a Windows password set, they could reformat the hard drive and reload Windows and have a functioning PC. However, even if they removed your hard drive and plugged the drive into another PC they would not be able to access your files on the drive.

As noted above, neither a BIOS password nor a Windows password will protect your PC or your data from a moderately competent advanced user but it will protect your data in the vast majority of cases.

Health Care Reform - Individual Policy - Fine Print

An individual health care policy is medical insurance purchased by an individual rather than a group health care policy which is typically provided by an employer. Since I have an individual health insurance policy, as do about 22.5 million Americans, I have closely followed the health care reform legislation as it impacts individual policy holders and have summarized the major impact on individual policy holders below.

1. Subsidies - Starting in 2014, the legislation provides subsidies for health care premiums for those with incomes below 4 times the federal poverty level (in 2010 about $44K for a single person). However, in order to receive the subsidy you will have to buy an insurance policy through a health insurance exchange. You will not receive a subsidy if you stay with your current policy. However, policies sold through the exchanges will have to provide very low or no co-pays, charge very low calendar year deductibles, not exclude or charge more for pre-existing conditions and must cover medical services which many policies do not cover or only cover for an additional premium. Consequently, the premium charged might be much higher than a current individual policy so even with the subsidy you might end up paying more than you do now. Premiums on the state exchanges can charge an older person up to 3 times the premium for a healthy young person (some carriers currently charge 10 times the premium for an older person) can charge 50% more for a smoker (most carriers currently charge 25% more for a smoker). If you are in your early 60's, don't smoke, have a low income and have expensive pre-existing conditions you will probably pay less but for others you may pay more.
   
2. Medical Loss Ratio is the percentage of medical insurance premiums that spent by the insurer on health care expenses (payments to hospitals, doctors, etc.) versus overhead expenses such as administration and profits. Starting in 2011, health insurers will be required to have a medical loss ratio of at least 80% for individual policies. Currently, health insurance is regulated by the individual states if regulated at all. In Florida, the state currently requires that insurers have a minimum medical loss ratio on individual policies so this change may lead to lower premiums on current policies in those states with minimum medical loss rations less than 80%. However, the legislation permits insurers to reclassify administrative expenses as medical expenses if the expense improves health care quality. WellPoint recently reclassified $500,000,000 of administrative expenses as medical expenses in anticipation of this change. The Secretary of Health and Human Services must approve of non medical expenses that are reclassified as medical expenses so the net impact of the 80% minimum medical loss is not clear. If you are in a state which currently has a low medical loss ratio you may see a premium decrease.
3. High Risk Pools will be established in July 2010 by some states and residents of states who elect not to establish a high risk pool will be eligible for coverage through a federal high risk pool. These pools are for individuals who are not able to get an individual medical insurance policy due to pre-existing conditions. In order to qualify for the high risk pool you must not be able to get insurance from an employer and must have been without insurance for at least 6 months. These high risk pools are temporary and will end as of 1/2014. However, only $5 billion is being provided to subsidize the premiums in the pools which is not expected to be nearly enough. If you currently have expensive pre-existing conditions and currently have an expensive insurance policy you would need to take the risk and out of pocket expense of going without insurance for 6 months in order to take advantage of the high risk pool.
4. Grandfathered insurance policies are those health insurance policies in effect prior to the health care reform being signed by the president in March 2010. These grandfathered policies are exempt from some of the requirements of the health care reform which require additional services, no exclusion or additional premium for pre-existing conditions and low co-pays and calendar year deductibles. I recently received my annual 15% premium increase from Blue Cross and inquired about increasing my deductible to off-set part of the $75/month premium increase. However, Blue Cross was still waiting for guidance from the Federal Government as to whether this would cause me to lose my grandfathered status so I elected not to make a change to my policy.
5. Higher taxes - Prior to reform, people with individual policies could deduct as an itemized expense on their federal tax the medical expenses paid including premiums that exceeded 7.5% of their adjusted gross income (AGI). Reform raised the threshold to 10% of AGI so even if you pay less in premiums you will pay more in taxes.
   

Several of the soundbites made during the campaign to pass the health care reform were misleading including;

If you like your current insurance you won't be required to change - This is true if you don't need or want the federal premium subsidy but if you do then you will be required to change.
Reform is required to combat increasing premiums - For individual insurance policies, the Congressional Budget Office (CBO) has estimated that in 2014, premiums on individual policies will be 13% less than they would be without health care reform. Using my current Blue Cross policy, I can look forward to only paying %52 more in 2014 in premiums rather than %75 more without the reform. A 52% increase in premiums in 4 years (+ $300 per month) is not nearly good enough and that is assuming that the CBO estimate is accurate.

If you currently have an individual medical insurance policy I would suggest that you consider all options but I have decided to keep my grandfathered policy until the impact on premiums of the new legislation is more clear. You might get better coverage with the new legislation but might end up paying much more in premiums even with the subsidy.