Tweet
"Possibly the most interesting of the seven security bulletins, though, is MS13-027. Microsoft only rates it as "important" because the attack requires physical access to the vulnerable machine. Andrew Storms, director of security operations for nCircle (currently in the process of being acquired by Tripwire), explains that this flaw allows anyone with a USB thumb drive loaded with the attack code to bypass security controls and access a vulnerable system even if AutoRun is disabled, and the screen is locked." (bolding mine.)