Feb 2, 2015: The IIS trust level for our Windows Hosting Servers has been changed from FULL to MEDIUM trust. This change was necessary as we encountered hack attempts warranting immediate evasive actions causing us to take urgent actions across all our Windows Servers without notice. Unfortunately, this change has resulted in some permission issues which we are trying to fix and will be addressed shortly. Our Senior Administrators are working on this issue at the highest priority and we should have all the issues resolved at the earliest.

In the meantime if you are using tag as Full in your web.config then you need to modify/remove it immediately. Here is a quick way to confirm the compatibility of websites to Medium Trust Level, in the local environment.

1. Add partially trusted callers attribute into AssemblyInfo.cs file of the website project, as following code snippet,

[assembly: AllowPartiallyTrustedCallers]

2. Add the following line into the web.config,

These measures were taken post encountering an exploit instance taking advantage of IIS Full Trust Level. In the past couple of months we have come across multiple instances where applications were trying to access restricted areas of the OS by exploiting Full Trust level and off late these activities have only increased. To protect the shared environment and avoid malicious activities we had to make this sudden change to ensure the service remains functional in an acceptable manner.

Please go through the below mentioned key points:

1. After this change, running applications with Full Trust level is no longer allowed. Any domain using as Full level in their web.config or assemblies using Full level permission will break. You need to comment/remove this tag completely. In order to give you time to get your sites fixed to work with the new permissioning, we have provided Full Trust level to all affected domains for a week. You need to fix the code during this period so that your sites can continue to function in the future.
2. Medium Trust Level would restrict your application to your application directory. So any application trying to access system sensitive folders, registries, network, eventlog details, etc. would fail.
3. We have allowed unrestricted permission for generic assemblies(viz oledb, SQL, odbc etc) under Medium Level on Custom basis.

List of Generic Assemblies Added :

AspNetHostingPermission
DnsPermission
EnvironmentPermission
FileIOPermission
IsolatedStorageFilePermission
PrintingPermission
SecurityPermission
SmtpPermission
SqlClientPermission
OleDbPermission
OdbcPermission
WebPermission
ReflectionPermission

4. We have temporarily allowed applications that we could identify to run on Full Trust for the rest of this week. If your application is currently designed to run under Full trust and we were unable to find it and give it temporary permissions to run, you need to modify your application to accommodate Medium trust else your application will break.

5. If your application is accessing OS assemblies or third party assemblies which run under Full trust level, they would no longer run.

6. If you are using a third party application which is not working in the Medium Trust mode, you need to contact your software vendor and ask them to give you an application which would work in the Medium Trust Level.

7. If we come across some exceptional generic assemblies being used by multiple CX applications, we will analyze the security impact and allow it to work under Medium Level Trust on Custom basis.

Ref : http://download.microsoft.com/download/d/4/b/d4b97c98-670a-4916-91e7-0d5eeba8236a/ASPNET35_HostingDeploymentGuide.doc