Microsoft Threat Intelligence says it found more than 3,000 publicly disclosed ASP.NET machine keys that could be used to forge ViewState and achieve remote code execution (RCE) on vulnerable IIS-hosted applications. That number is an exposure count, not a breach count: Microsoft separately reported limited malicious activity in December 2024 involving one publicly disclosed key.
What Microsoft found
In an incident analysis published February 6, 2025, Microsoft Threat Intelligence warned that publicly posted ASP.NET machine keys can enable ViewState code-injection attacks. The keys may have appeared in source repositories, sample configurations, tutorials, or other public material and then been copied into production applications.
Microsoft identified over 3,000 publicly disclosed keys that could be used for this attack class. It did not say that all of those keys were still deployed, usable against a live application, or associated with a confirmed compromise.
Microsoft also described one observed case from December 2024. An unattributed actor used a publicly known machine key in limited malicious activity. The payload reflectively loaded assembly.dll, a file associated with the Godzilla post-exploitation framework and plugin modules. Microsoft reported the file’s SHA-256 as 19d87910d1a7ad9632161fd9dd6a54c8a059a64fc5f5a41cf5055cd37ec0499d.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What are ASP.NET machine keys?
ASP.NET Web Forms uses ViewState to preserve page and control state between requests. The state is sent back to the server in a hidden form field and encoded with Base64.
A machineKey configuration supplies cryptographic material used by ASP.NET when processing that data:
- The ValidationKey supports a message-authentication code (MAC), allowing ASP.NET to detect tampering.
- The DecryptionKey is used when ViewState encryption is configured.
Keys can be generated automatically or set explicitly in configuration. A fixed value is often used in a web farm so every server can validate requests created by another server. That operational convenience becomes dangerous when the value is copied from a public example or otherwise disclosed.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Can a leaked key allow remote code execution?
It can, when the exposed key is usable by the target application and the application follows a vulnerable ViewState processing path. An attacker who knows the relevant key material can construct a malicious ViewState, submit it to the site, and have the ASP.NET runtime accept it as authentic. Microsoft says malicious code can then be loaded into the IIS worker-process memory and executed.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →This is a conditional risk, not a claim that every ASP.NET deployment is exploitable. A key match must be considered alongside the application’s framework, configuration, reachable Web Forms endpoints, and evidence of suspicious processing.
Why the “1000s” figure needs context
| Microsoft observation | What it means |
|---|---|
| Over 3,000 publicly disclosed ASP.NET machine keys | Keys Microsoft assessed as potentially usable for ViewState code-injection attacks; not a count of confirmed intrusions. |
| One publicly disclosed key used in limited malicious activity in December 2024 | An observed incident example, separate from the larger exposure count. |
A publicly exposed key is therefore a security finding that warrants validation and investigation. It is not, by itself, proof that an attacker reached the server or executed code.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
How to check whether a key was exposed
Use Microsoft Defender for Endpoint when available
Defender for Endpoint can raise the Publicly disclosed ASP.NET machine key alert. Microsoft classifies this alert as informational: it indicates the presence of known exposed key material, not confirmed attack activity.
Compare configured keys with Microsoft’s hashes
Microsoft provides hashes for identified public keys and a script that compares those hashes with static keys in an environment. A match means the configured material is publicly disclosed. It should trigger application and host investigation rather than being treated as a confirmed compromise.
Review the application and host
- Identify every application using the matching
machineKeyand determine whether it is ASP.NET Web Forms on .NET Framework. - Check whether the application exposes ViewState-processing pages to the internet.
- Review IIS, application, authentication, and endpoint telemetry for unusual requests or worker-process behavior.
- Look for unexpected assemblies, web shells, new accounts, scheduled tasks, services, and persistence mechanisms.
How to rotate keys safely
Fixed keys in a web farm
- Generate new cryptographically secure validation and, where required, decryption values. Do not copy values from public examples.
- Deploy the same new values to every server that must process the farm’s requests.
- Coordinate the change so all load-balanced nodes use the new configuration; mismatched values can invalidate sessions or ViewState.
- Validate sign-in, postback, session, and deployment health after the change.
Microsoft recommends regular rotation and secure handling of the machineKey section. At deployment, encrypt sensitive machineKey and connectionStrings elements in web.config.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
One server with a fixed machineKey
For a single ASP.NET server outside Exchange Server and SharePoint, Microsoft says removing the fixed machineKey element returns the application to automatically generated values stored in the computer’s registry. Confirm that the application does not depend on a particular fixed value before removing it, and test the resulting session and authentication behavior.
SharePoint and Exchange are separate cases
Microsoft’s general guidance excludes Exchange Server and SharePoint from the generic procedure. SharePoint administrators should use SharePoint-specific instructions. SharePoint Server Subscription Edition encrypts the machineKey section in web.config by default. Microsoft documents automatic rotation for Subscription Edition Version 25H1 and for SharePoint Server 2016 and 2019 beginning with the September 2025 Public Update.
SharePoint farm tooling distributes keys across the farm. A local-only edit can leave load-balanced servers with different keys and cause sessions to fail.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Does key rotation fix a compromised server?
No. Rotation prevents future validation with the old key, but it does not remove code an attacker may already have installed. If logs or endpoint telemetry suggest successful exploitation, preserve evidence and investigate for backdoors and persistence before declaring the incident closed.
Microsoft describes web-facing servers as particularly exposed and says that, when public keys are found in a system with possible successful exploitation, reformatting and reinstalling from offline media should be strongly considered. That is high-severity incident-response guidance, not an automatic requirement for every informational key match.
Detection signals and their limits
| Signal | Interpretation |
|---|---|
| Publicly disclosed ASP.NET machine key alert | Informational evidence that known exposed key material is present; not proof of attack activity. |
| IIS worker process loaded suspicious .NET assembly alert | May indicate malicious code loading, but Microsoft cautions that unrelated threat activity can also trigger it. |
| Unexpected assembly, web shell, persistence, or anomalous requests | Stronger evidence requiring incident-response investigation and containment. |
Validation is not encryption
ASP.NET’s MAC validation helps detect tampering; it does not make ViewState confidential. Microsoft Learn states that ViewState is validated but not encrypted by default, and documents HMACSHA256 as the default MachineKeyValidation algorithm. Enabling encryption does not make a publicly disclosed key safe, and MAC validation alone does not provide secrecy.
Quick Recap
Additional hardening Microsoft recommends
- Generate keys securely and keep them out of public repositories, samples, and deployment logs.
- Rotate fixed keys regularly, with coordinated changes across every farm node.
- Encrypt sensitive
machineKeyandconnectionStringsconfiguration sections during deployment. - Upgrade applications to ASP.NET 4.8 to enable available Antimalware Scan Interface (AMSI) capabilities.
- Harden Windows Server with attack-surface-reduction rules, including rules that block web-shell creation where appropriate.
- Monitor internet-facing IIS worker processes and investigate unexpected .NET assembly loads.
What administrators should do now
- Inventory ASP.NET applications, their framework versions, exposed Web Forms endpoints, and all configured
machineKeyvalues. - Compare static values with Microsoft’s published-key hashes or use the Defender for Endpoint informational alert.
- If a value matches, determine whether it is active, rotate or remove it using the correct single-server or farm procedure, and validate the application.
- Review endpoint and server telemetry for suspicious ViewState requests, assembly loads, web shells, and persistence.
- If exploitation is plausible, move from key hygiene to full incident response; do not treat rotation as eradication.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
