As far as I can tell, the AesCryptoServiceProvider they are using inherits the default CBC mode from here:

http://msdn.microsoft.com/en-us/library/system.security.cryp...

So, it appears to be using CBC. However, their ciphertext is not authenticated so is still insecure.