IIRC a talk by Travis Goodspeed mentioned that it was only internally disabled for USB and writeable media. If a USB device presents itself as a CDROM, it can s

IIRC a talk by Travis Goodspeed mentioned that it was only internally disabled for USB and writeable media. If a USB device presents itself as a CDROM, it can still autorun things unless globally disabled by the user. Or it could emulate a disk + HID keyboard, and enter the win+r filename.exe <RET> keystrokes necessary to launch it, or one of several other tricks. It could also intercept mass storage requests, wait til you're copying an exe onto there (even if you've reformatted the drive since), and inject a payload into it.