[jmj42]

Autoplay isn't required for these kinds of attacks. I'll confess that I did not watch the actual talk (linked elsewhere), so I don't know if that route was used in this case. I do know, however, that autoplay is not actually required.

Here's a video of a demonstration given back in November of a system (Crossing Guard) being developed at Dartmouth (under the Trustworthy Cyber Infrastructure for the Power Grid). The attack takes advantage of lower level USB operation and does not rely on autoplay.

http://youtu.be/NIlmDpUDudo

[Edit: missing 'not']

[taejo]

The attack in the video, AIUI, doesn't use autoplay: they plug the USB drive in and then restart the machine so it boots off the drive.