This isn't really a new attack, but it is pretty cool way of automating it. Other comments mention this being mitigated with full disk encryption and a firmware password.

As mentioned in the OpenBSD FAQ[1] an attacker with physical access wins.

[1]http://www.openbsd.org/faq/faq8.html#LostPW