I wonder what access to physical hardware and social engineering his security holes will need? In the past, many of these exploits required quite a bit of user intervention including the administrator password.
For example,
"
No one was able to execute code on any of the systems on Wednesday, the first day of the contest, when hacks were limited to over-the-network techniques on the operating systems themselves. But on the second day, the rules changed to allow attacks
delivered by tricking someone to visit a maliciously crafted Web site, or open an e-mail. Hackers were also allowed to target "default installed client-side applications," such as browsers.
The team had attack code already set up on a Web site, and was able to gain access to the MacBook Air and retrieve a file after judges were "tricked" into visiting the site. According to the TippingPoint DVLabs blog, a newly discovered vulnerability in Safari was used to gain control of the Air.
…
Last year's contest was won by exploiting a QuickTime vulnerability, which was patched by Apple in less than two weeks.”
http://news.cnet.com/8301-13579_3-9905095-37.html
By the way, before anyone gets too crazy bashing this guy — I believe the rules of the conference dictate that he sign a NDA and that all exploits will be reported to Apple.