News Items

There is the promise of chiplets within the semiconductor ecosystem, but security in these chiplets and the heterogeneous systems into which they will be implemented needs more attention. Disaggregating a System-on-Chip (SoC) into a chiplet changes the cybersecurity threat landscape. Chiplets can be developed anywhere and at any process node, unlike monolithic multi-function chips, which are typically produced using the same process technology. One of the primary reasons for developing heterogeneous chiplets is that not all functions benefit from the most advanced process technology, nor can they all fit on a single die. However, this increases the threat level, and the industry needs help to address security issues in a repeatable and cost-effective manner. Integrating multiple chiplets into a heterogeneous package introduces security incidents and potential risks associated with malicious modifications or attacks on individual chiplets during design, assembly, or testing. Additionally, since chiplets are often designed and manufactured by various vendors, there is a possibility that a malicious actor could compromise one of the vendors and use that access to compromise the entire chiplet-based system. This article continues to discuss the magnitude of the security challenges for commercial chiplets.

semiEngineering reports "Chiplet Security Risks Underestimated"

An Estonian national has been recently charged in the United States for purchasing US-made electronics and computer hacking tools on behalf of the Russian government and military. The man, Andrey Shevlyakov, was arrested in Estonia on March 28. He was charged in the US on 18 counts of conspiracy and other charges. According to the indictment, Shevlyakov did business through several Estonian-based shell companies that he and his co-conspirators used to export microelectronics from the US to Estonia. The goods were then shipped to Russia, thus circumventing export regulations. The indictment noted that since 2012, Shevlyakov was placed by the US government on a ban list for procuring and delivering export-restricted items to Russia. To evade the list's restrictions, he used false names and shell companies to order items and pay for them. Purchased items include integrated circuits, low-noise pre-scalers, resistors, synthesizers, analog-to-digital converters that are found in defense systems, including avionics, electronic warfare systems, missiles, and software-defined radio. According to the indictment, email communication between Shevlyakov and a Russia-based individual has revealed that Shevlyakov also attempted to acquire a licensed copy of Metasploit Pro, a US-made penetration testing tool that cannot be purchased from Russia directly. Metasploit is a highly popular hacking tool that has often been abused by malicious actors. The software has a free version and a Pro version, which costs roughly $15,000. Between 2012 and 2022, Shevlyakov exported at least $800,000 worth of US electronics. If convicted, Shevlyakov faces up to 20 years in prison.

SecurityWeek reports: "DoJ: Estonian Man Tried to Acquire US-Made Hacking Tools for Russia"

Attackers have been avoiding detection by exploiting legitimate YouTube attribution links and a Cloudflare CAPTCHA. According to the cybersecurity company Vade, using YouTube attribution links is a novel method for circumventing email filters that scan for suspicious redirects. In a new phishing campaign, victims receive a spoofed email claiming that their Microsoft 365 password has expired. Personalizing and contextualizing the email creates the illusion of legitimacy. Researchers observed that the email contains no misspellings or grammatical errors, which are typically early indicators of fraud. Below the notice regarding the victim's password allegedly being expired, there is an option to keep the current password. The button, which is hyperlinked to a YouTube URL, eventually takes users to a phishing page with a Cloudflare CAPTCHA. According to Vade, it is likely that the page is hosted on Cloudflare and uses URL crawling and bot protections. Once users click the CAPTCHA, they are presented with a fake Microsoft 365 sign-in page, allowing threat actors to steal their credentials and take control of their accounts. This article continues to discuss the new phishing campaign involving the exploitation of YouTube attribution links.

Cybernews reports "YouTube Attribution Links Exploited in New Phishing Campaign"

Google has recently unveiled a new policy for Android apps that enable account creation. The rule mandates such apps to provide users with an option to delete both the accounts and the data associated with them. Bethel Otuteye, senior director of product management at Android App Safety, said it aims to empower users with greater control over in-app data. Google stated that for apps that enable app account creation, developers will soon need to provide an option to initiate account and data deletion from within the app and online. Google noted that this web requirement, which one will link in their Data safety form, is especially important so that a user can request account and data deletion without reinstalling an app. Google clarified that while Google Play's data safety section already allows developers to showcase data deletion options, it aims to provide users with a more accessible and consistent way to request them. The new policy means that when developers fulfill a request to delete an account, they must also delete the associated data. Google noted that the feature will also enable users not wishing to delete their entire account to only remove some data types like images, videos, or history. Otuteye clarified that developers needing to retain specific data for legitimate reasons (e.g., security, fraud prevention, or regulatory compliance) would have to disclose those data retention practices.

Infosecurity reports: "Google Mandates Data Deletion Policy For Android Apps"

In the last year, nearly half of cybersecurity practitioners have been instructed by senior management to keep data breaches "under wraps." Bitdefender's survey of 400 Information Technology (IT) and security professionals revealed that 42 percent had been told to keep a breach secret when they knew it should be reported. Similarly, 30 percent of respondents said they actively avoided disclosing a breach despite the existence of specific processes. Seventy-one percent of security professionals in the US failed to notify senior management or customers when they knew a breach should have been disclosed. Security practitioners in the UK, France, Germany, Spain, and Italy were among the least likely to keep a security breach secret. Over half of global respondents reported that their organization had experienced a data breach or leak within the past 12 months. Seventy-two percent of respondents in the US reported experiencing such an incident. The study also revealed that 55 percent of respondents are increasingly concerned that their company will face legal action because of improper handling of an incident. This article continues to discuss key findings regarding security practitioners failing to disclose data breaches.

ITPro reports "Nearly Half of Security Practitioners Told to 'Keep Data Breaches Under Wraps'"

Cybercriminals are targeting victims with well-crafted phishing attacks from QuickBooks online accounts to steal credentials. According to researchers from Avanan, the scheme is at a level of legitimacy and social engineering that suggests new Business Email Compromise (BEC) efforts. As the security and detection for BEC attacks are strengthened, cybercriminals are switching to even more evasive tactics, as demonstrated by the attacks. Avanan researchers refer to this evolution of attacks as "BEC 3.0." Researchers report that threat actors are now registering for free accounts for legitimate services and then targeting victims from those services using email addresses at domains that traditional scanning tools will not detect. This article continues to discuss BEC 3.0 attacks involving QuickBooks online accounts.

Dark Reading reports "'BEC 3.0' Is Here With Tax-Season QuickBooks Cyberattacks"

The US Homeland Security Department's Cybersecurity and Infrastructure Security Agency (CISA) has released eight advisories regarding critical vulnerabilities in Industrial Control Systems (ICS) products from Hitachi Energy, mySCADA Technologies, Industrial Control Links, and Nexx. One of the vulnerabilities, tracked as CVE-2022-3682, affects Hitachi Energy's MicroSCADA System Data Manager SDM600 and could allow an attacker to assume remote control of the product. A flaw in the validation of file permissions allows an adversary to upload a specially crafted message to the system, leading to the execution of arbitrary code. Another set of five critical vulnerabilities involves command injection bugs present in mySCADA myPRO versions 8.26.0 and prior. The successful exploitation of these vulnerabilities could enable an authenticated user to inject arbitrary operating system commands, CISA warned, urging users to upgrade to version 8.29.0 or higher. Industrial Control Links ScadaFlex II SCADA Controllers contain a critical security flaw that could enable an authenticated attacker to overwrite, delete, or create files. This article continues to discuss CISA's warning of critical ICS flaws.

THN reports "CISA Warns of Critical ICS Flaws in Hitachi, mySCADA, ICL, and Nexx Products"

Almost everyone in the digital age has likely, at some point, needed to access cloud-stored documents and data but forgot their password and had to create a new identity. For researchers with allocations for high-performance computing and services across multiple locations, that situation can result in delayed progress on important scientific efforts and questionable online security. CILogon, a software development effort at the University of Illinois Urbana-Champaign's National Center for Supercomputing Applications (NCSA), was launched to facilitate secure logins to scientific cyberinfrastructure. Using CILogon, users can access any online location at which they or their research group have an allocation using credentials from their primary organization. According to the researchers behind CILogon, it is as easy and seamless as logging into a Google or Facebook account, allowing researchers to access resources located on different sites without requiring Information Technology (IT) support to create new identities. This article continues to discuss the goals, development, and applications of NCSA's CILogon.

The University of Illinois Urbana-Champaign reports "Security Made Simple With NCSA's CILogon"

As cars become more connected, they will face more security challenges. Connectivity involves all vehicle components, encompassing everything from autonomous driving to connected infotainment and in-cabin monitoring. In addition, it includes external sensors, Internet of Things (IoT), Vehicle-to-Everything (V2X), Over-the-Air (OTA) communication, and remote control. Different regional standards, an endless series of updates, the introduction of new technologies, and a growing concern for security exacerbate the difficulty of making all this technology function together. Most vehicles are equipped to connect to cellular and wireless infrastructure, as well as to wired and wireless devices. The majority of cabins also have the ability to connect to a wide variety of personal devices. As vehicles become more connected and software-defined, new challenges will emerge, such as how to future-proof vehicle and software architectures, cybersecurity, networking issues, and other problems typically associated with computer systems. This article continues to discuss the security challenges associated with connected vehicles.

semiEngineering reports "Growing Challenges For Increasingly Connected Vehicles"

A mid-sized law firm representing Uber has recently notified an unknown number of its drivers that sensitive data has been exposed and stolen due to a cyberattack. New Jersey-based Genova Burns disclosed the breach in an email to customers. The company determined that an unauthorized third party gained access to their systems, and certain limited files were accessed or exfiltrated between January 23, 2023, and January 31, 2023. The investigation determined that information drivers provided to Uber, including names, Social Security numbers, and/or Tax Identification Numbers, were among the impacted data. Genova Burns added that they are currently investigating the incident with law enforcement. The firm said it changed all its system passwords and is offering affected drivers 12 months of complimentary identity monitoring services through Kroll.

Infosecurity reports: "Uber Drivers' Data Exposed in Breach of Law Firm's Servers"

According to Rajat Kumar, a Ph.D. student in Yehia Massoud's lab at King Abdullah University of Science and Technology (KAUST), it is not inconceivable for a malicious employee of a company that implants chips in about 50 percent of the world's computers to embed a Trojan in systems globally and hold the world to ransom. Massoud's group explores emerging technologies that could improve the security of chips. Their recent research reveals multifunctional logic gates that provide users with various hardware security benefits. These include improved device control, protection against tampering, watermarking, fingerprinting, and layout camouflage. Massoud explains that tampering with chips is possible even if a semiconductor foundry is trustworthy because an untrusted entity in the supply chain could tamper with chips. In a case involving chips for a country's defense force, a breach could compromise an entire country's security. Components sourced from a complex supply chain pose risks of intercepted and reverse-engineered classified chips, counterfeiting, and intellectual property theft. Kumar and colleagues delved into polymorphic gates made from nanoscale structures composed of an oxide layer sandwiched between two ferromagnetic layers as a secure alternative. This article continues to discuss the research on multifunctional logic gates offering hardware security advantages.

King Abdullah University of Science and Technology reports "Simulating a Secure Future"

Google recently announced the release of Chrome 112 in the stable channel with patches for 16 vulnerabilities, including 14 reported by external researchers. Of the externally reported flaws, two are rated high severity, nine have a medium severity rating, while the remaining three are low-severity issues. Google noted that the most severe of these is a heap buffer overflow bug in Visuals. Tracked as CVE-2023-1810, the vulnerability earned the reporting researcher a $5,000 bug bounty reward. CVE-2023-1810 can allow a compromised renderer to register multiple things with the same FrameSinkId, violating ownership assumptions. Next in line is a use-after-free flaw in Frames, which is tracked as CVE-2023-1811, and for which Google awarded a $3,000 bug bounty. The issue could lead to a crash or malicious code execution. Google noted that the resolved medium-severity vulnerabilities include out-of-bounds memory access, inappropriate implementation, insufficient validation of untrusted input, use-after-free, incorrect security UI, insufficient policy enforcement, out-of-bounds read, and heap buffer overflow issues. Impacted Chrome components include DOM Bindings, Extensions, Safe Browsing, Networking APIs, Picture In Picture, Intents, Vulkan, Accessibility, and Browser History. The three low-severity flaws addressed with the Chrome 112 release impact the WebShare, Navigation, and FedCM components. Google says it has paid roughly $26,000 in bug bounty rewards for the reported vulnerabilities, but the final amount might be higher, as the internet giant has yet to determine the amount to be handed out for two of the bugs. Google did not mention if any of these vulnerabilities were exploited in attacks. The latest Chrome iteration is now rolling out as version 112.0.5615.49/50 for Windows and as version 112.0.5615.49 for Linux and macOS.

SecurityWeek reports: "Chrome 112 Patches 16 Security Flaws"

The creators of the Typhon information-stealing malware claimed on a dark web forum that they had updated the malware to a new version, which they now market as "Typhon Reborn V2." They revealed improvements intended to prevent analysis via anti-virtualization methods. Malware analysts found the original Typhon in August 2022. At the time, Cyble Research Labs discovered that the malware bundled the main stealer component with a clipper, a keylogger, and a cryptocurrency miner. Although the initial version of Typhon was sold over Telegram for a one-time payment of $50, its creators also offered to distribute it for about $100 per 1,000 victims. Since January, the new version has been advertised on the dark web and purchased several times, according to Cisco Talos analysts. However, the researchers found samples of the new variant in the wild that dated back to December 2022. According to Cisco Talos, the Typhon V2 codebase has been updated to make the malicious code more robust, reliable, and stable. This article continues to discuss researchers' findings and observations regarding the new version of Typhon information-stealing malware.

Bleeping Computer reports "Typhon Info-Stealing Malware Devs Upgrade Evasion Capabilities"

CryptoClippy, a new malware capable of stealing cryptocurrency, is currently targeting Portuguese users as part of a malvertising campaign. The activity involves Search Engine Optimization (SEO) poisoning techniques to lure people searching for "WhatsApp web" to malicious domains, according to Palo Alto Networks Unit 42. CryptoClippy, an executable written in C, is a type of cryware called clipper malware that monitors a victim's clipboard for cryptocurrency addresses and replaces them with a wallet address under the control of the threat actor. According to Unit 42 researchers, the clipper malware uses regular expressions (regexes) to determine the type of cryptocurrency associated with an address. It then replaces the clipboard entry with a visually similar wallet address for the corresponding cryptocurrency that an attacker owns. When the victim pastes the address for a transaction, they send cryptocurrency directly to the threat actor. This article continues to discuss the researchers' findings and observations regarding CryptoClippy.

THN reports "CryptoClippy: New Clipper Malware Targeting Portuguese Cryptocurrency Users"

A security researcher has tricked ChatGPT into creating sophisticated data-stealing malware that signature- and behavior-based detection tools will be unable to identify, evading the chatbot's anti-malicious-use protections. Without writing code, the researcher, who admitted to having no experience developing malware, guided ChatGPT through a series of simple prompts that resulted in a malware tool capable of silently searching a system for certain documents, breaking them up, inserting them into image files, and sending them to Google Drive. According to Aaron Mulgrew, solutions architect at Forcepoint and one of the malware's authors, it took about four hours from the initial prompt into ChatGPT to have a working piece of malware with no detections on VirusTotal. Mulgrew noted that the purpose of his experiment was to demonstrate how simple it is to circumvent the protections ChatGPT has to prevent the creation of malware that would ordinarily require significant technical expertise. This article continues to discuss ChatGPT being convinced to create malware for finding and exfiltrating specific documents even though there is a directive to refuse malicious requests.

Dark Reading reports "Researcher Tricks ChatGPT Into Building Undetectable Steganography Malware"

Rorschach is a potentially record-breaking ransomware in regard to encryption speeds. It has been found in the wild, locking up systems at nearly twice the rate of the infamous LockBit 3.0 malware. According to tests conducted by Check Point Research (CPR), Rorschach can encrypt 220,000 local drive files within four and a half minutes. In comparison, LockBit 3.0 completed the task in seven minutes, which is significantly faster than the median encryption time determined through testing in the previous year. Even more noteworthy is the fact that Rorschach ransomware is highly configurable. CPR analysis found that by adjusting the number of encryption threads via the command line argument, it is possible to achieve even faster times. In addition to its efficiency, Rorschach is notable because it contains known components taken from the leaked source code of other ransomware strains. The operators behind Rorschach do not use an alias or brand their malware, which is rare in the ransomware realm, where reputation is important, and self-promotion is rampant. Therefore, the resulting malware strain is open to interpretation regarding who its operators are and how it fits into the ecosystem. This article continues to discuss researchers' findings regarding the new Rorschach ransomware.

Dark Reading reports "Mysterious 'Rorschach' Ransomware Doubles Known Encryption Speeds"

Attackers are abusing the reputation and openness of the popular public JavaScript software registry NPM to spread malware and carry out scams, while launching Distributed Denial-of-Service (DoS) attacks against the service at the same time. According to Jossef Harush Kadouri, head of software supply chain security at Checkmarx, the load generated by automated scripts rendered NPM unstable with "Service Unavailable" errors. Kadouri's documentation highlights that attackers abuse NPM to conduct Search Engine Optimization (SEO) poisoning for malware-delivery campaigns, spam campaigns, cryptocurrency scam campaigns, and phishing campaigns. This year, Checkmarx discovered a flash attack in which multiple user accounts published more than 15,000 phishing packages in a matter of hours, and found that such attacks are common. Kadouri explains that as long as the name is not taken, they can publish an unlimited number of packages on NPM. The number of package versions released on NPM is typically about 800,000. The previous month's total exceeded 1,400,000 due to the volume of spam campaigns. This article continues to discuss the ways in which attackers misuse NPM as well as the launch of NPM DoS attacks.

Help Net Security reports "Flood of Malicious Packages Results in NPM Registry DoS"

Attackers are claiming that data for sale on the dark web belongs to Rogers Communications, a Canadian media giant that provides wireless, cable, and Internet services. The advertisement includes three of Rogers' Active Directory (AD) databases: users, groups, and devices. AD typically contains critical information about the company's environment, such as what users can do and which devices operate within the system. Rogers has confirmed that some of the company's information has been leaked onto the dark web. However, according to a company spokesperson, only employee information was compromised, and no customer information was included in the leaked database. Cybernews reviewed data samples from the three AD databases included in the advertisement, which contained customer names and surnames, phone numbers, email addresses, locations, company names, account launch dates, user device operating systems, user roles, device security statuses, and other sensitive data. While the samples do not include employee data, the Cybernews research team suspects that the AD could also contain information on the company's employees who use Rogers' network resources, since this information is typically stored in AD databases. This article continues to discuss the Rogers Communications data leak.

Cybernews reports "Rogers Communications Data Allegedly Sold on a Hacker Forum"

Researchers from Purdue University have discovered vulnerabilities in Smart TVs that can allow attackers to take control of the devices and steal any data stored on them. Google has acknowledged a vulnerability, tracked as CVE-2021-0889, in its Android TV platform and has made modifications to address it. Professor of electrical and computer engineering and computer science at Purdue Saurabh Bagchi and his team have developed technology to understand the security of smart Internet of Things (IoT) devices over the past five years. In addition to finding vulnerabilities, their work defines the security properties of virtual remote devices, allowing for the secure development of future devices, according to co-investigator Aravind Machiry. The research team discovered the flaw in the Wi-Fi remote protocol and demonstrated that an attack involving its exploitation targets the four most popular Over The Top (OTT) digital streaming platforms. To put this theory into practice, the team created and demonstrated the feasibility of Spook, which is a piece of malware packaged in an Android smartphone that can take control of an Android TV device. The team designed and implemented an ARM TrustZone-based defense that ensures a human is initiating the pairing. This defense prevents Spook and any User Interface (UI) injection-based attack on Smart TVs through a secure version of the Wi-Fi remote protocol. This article continues to discuss the discovery of vulnerabilities in Smart TVs and the mitigation developed by researchers at Purdue University.

Purdue University reports "Purdue Researchers Uncover Vulnerabilities in Smart TVs"

A team of five student researchers from the Intelligent Systems Laboratory (ISL) at Fayetteville State University (FSU) recently placed third in a nationwide cybersecurity hackathon event held at FSU's Center for Defense and Homeland Security (CDHS). The hackathon, coordinated by Arizona State University (ASU) under a grant from the US Department of Homeland Security (DHS), invited 23 teams of four to six students from 11 colleges and universities across the country. A panel of judges selected nine winning teams in total. The event included a student design challenge called Designing Actionable Solutions for a Secure Homeland (DASH) and provided students with several real-world scenarios impacting homeland security. The topic "Protecting America's Public Access Places" required each team to select one of three designable solutions. Team Broncos, composed of some of FSU's brightest students, designed a comprehensive system using Artificial Intelligence (AI) for real-time object detection and anti-drone drones in order to combat unauthorized drone activities. Their approach would mitigate drone attacks, increase response time, and improve law enforcement communication. This article continues to discuss the nationwide cybersecurity hackathon event held at FSU's CDHS and the solution demonstrated by FSU's team of student researchers that won them third place.

Fayetteville State University reports "Fayetteville State University Students Place Third in Nationwide Cybersecurity Hackathon"

Several solutions for information encryption, anti-counterfeiting, and secure communication have emerged as the world generates more data. Researchers at Nanyang Technological University (NTU) want to contribute by developing a new way to encode information using biological lasers, taking advantage of the sensitivity of enzyme-based reactions. The lasers are generated by shining light through droplets of alginate, a polymer from seaweed, that were sandwiched in a Fabry- Perot microcavity. The researchers used the enzyme alginate lyase to break down the alginate, causing the droplets to swell and shifting the emitted laser's wavelengths. The scientists could use the lasers to encrypt information revealed only under certain environmental stimuli by controlling the rate of the reaction and size of the droplet. According to assistant professor Chen Yu-Cheng of NTU's Department of Electrical and Electronic Engineering and School of Chemistry, Chemical Engineering, and Biotechnology, combining biology with photonics invites novel applications in secure communication and smart sensing. This article continues to discuss the work on using biological lasers for secure communication.

Nanyang Technological University reports "Lasers for Secure Communication"

Malicious actors behind credential harvesting attacks are spreading customized phishing links using a distributed file protocol. Since the InterPlanetary File System (IPFS) is designed to be resilient against content takedowns, researchers report that scammers are using it to send phishing emails at scale. IPFS functions as a peer-to-peer (P2P) network of nodes that individually store fragments of files accessible via a unique fingerprint called a "content identifier." Files are stored and retrieved based on their content identifier instead of their location on a remote server. In a white paper, the protocol's creator Juan Benet compared it to "a single BitTorrent swarm, exchanging objects within one Git repository." The protocol benefits cybercriminals because it reduces the cost of phishing web page hosting, and its distributed nature makes it nearly impossible to delete files. Researchers first spotted URL addresses of malicious IPFS files in October 2022. February 2023 was the busiest month for IPFS phishing activity, with nearly 400,000 attempts detected by researchers. The scammers upload HTML files containing a phishing form into IPFS and then attempt to convince victims to click on proxy links leading them into a gateway to access the files. This article continues to discuss attackers' use of the IPFS protocol to distribute phishing links.

GovInfoSecurity reports "Phishing Campaign Goes Cutting-Edge With IPFS"

Researchers at Carnegie Mellon University's (CMU) CyLab Security and Privacy Institute have been working on privacy nutrition labels, seeking a quick and simple approach to enlighten technology users on how their data is being collected and used. Apple has started requiring app developers to provide this type of information through privacy labels displayed in the iOS App Store. However, app developers are often found struggling to create accurate privacy labels. According to Norman Sadeh, co-director of CMU's Privacy Engineering Program and head of the Usable Privacy Policy Project, a lack of guidance, a long list of complicated terms, and a lack of privacy expertise among app developers often lead to inaccurate labeling. Inaccurate labeling misleads users regarding the data that an app may gather and how it processes that data. In addition, it exposes app developers to regulatory penalties. Therefore, Sadeh and his team have developed a new tool called Privacy Label Wiz (PLW), which provides app developers with an easy-to-use, step-by-step guide for successfully disclosing the data practices of their apps. This article continues to discuss the PLW tool aimed at helping developers create more accurate iOS privacy labels.

CyLab reports "New Tool Helps Mobile App Developers Create More Accurate iOS Privacy Labels"

The emergence of synthetic media, such as OpenAI's ChatGPT is changing the production and consumption of content. Like any technological breakthrough, synthetic media ignites concerns regarding data privacy, security, ethical issues, and more. Several professionals in the field of privacy are concerned that synthetic media will do more harm than good because it increases the number of attack vectors. Criminals have already developed websites that spoof ChatGPT and other OpenAI platforms in order to trick users into handing over sensitive information or downloading malware. Other concerns include the ability of the technology to create convincing fake comments, videos, or other media, resulting in the spread of false information. This article continues to discuss the privacy risks associated with the rise of synthetic media such as ChatGPT and the suggested GUT Check that users are encouraged to implement to protect their data when using new technology.

The University of Utah reports "A Data Privacy 'GUT Check' for Synthetic Media like ChatGPT"