>>> If I understand the exploit correctly, attackers are able to make >>> a series of bad requests, record the error page display timing, >>> and eventually

>>> If I understand the exploit correctly, attackers are able to make >>> a series of bad requests, record the error page display timing, >>> and eventually figure out the machine key used for AES encryption. Yes. >>> I don't use ViewState any more, having moved on to ASP.NET MVC (From my inherently limited understanding) this is not just ViewState. That's just one of the multiple things vulnerable. I think they also mentioned ASP.NET MVC being vulnerable, too.