The exploited is detailed here: http://seclists.org/fulldisclosure/2010/Jan/341

My favorite part comes at the end. The last step involves predicting where a specific BIOS handler lies in memory. It is a static address in all pre-Vista OS.

Starting in Vista, Windows introduced address space layout randomization to make hacks like this more difficult.

However: "Unfortunately, this potentially useful exploit mitigation is trivial to defeat locally as unprivileged users can simply query the loaded module list via NtQuerySystemInformation()."

Whoops.