Dr. Vincent Olatunji, CEO/ National Commissioner of Nigeria Data Protection Commission has approved the extension of deadline for the registration of Data Controllers and Data Processors of Major Importance (DCPMIs).

The commission in a statement issued on Friday by Babatunde Bamigboye, Head, Legal, Enforcement & Regulations, said that the new deadline for registration without penalty is the 31st of October, 2024.

The statement reads, “In order to ensure accountability and in line with sections 24(3), 29(1)(a) and 44 of the Nigeria Data Protection Act, 2024 (NDP Act), DCPMIs shall only engage agents and contractors who are duly registered with the Commission (as at 15th October, 2024) for the processing of personal data”.

For ease of reference, section 29(1)(a) of the NDP Act provides: “Where a data controller engages the services of a data processor, or a data processor engages the services of another data processor, the data controller or data processor engaging another shall ensure that the engaged data processor —

(a) complies with the principles and obligations set out in this Act as applicable to the data controller;

“Furthermore, Section 65 of the NDP Act defines a data processor “as an individual, private entity, public authority, or any other body, who processes personal data on behalf of or at the direction of a data controller or another data processor.”

The Commission enjoins data controllers and data processors of major importance to immediately ensure that those who process personal data on their behalf fulfill the obligation to register as required by law. Engaging an agent or contractor who does not comply with the principles and obligations (set out in the NDP Act) that are applicable to the data controller is a contravention of the NDP Act.

Between January 2023 and September 2024, Kaspersky Digital Footprint Intelligence experts identified 547 listings to buy and sell exploits targeting software vulnerabilities.

These advertisements are posted on various dark web forums and shadow Telegram channels, with half involving zero-day and one-day vulnerabilities.

However, it is difficult to confirm whether these exploits are functional, as the dark market is rife with scams. Additionally, Kaspersky found that, on average, the cost of exploits for remote code execution vulnerabilities amounted to $100,000.

Exploits are tools used by cybercriminals to take advantage of vulnerabilities in various software programs, like those from Microsoft, to commit illegal activities, such as gaining unauthorised access or stealing data.

More than half of the dark web posts (51%) offered or sought to purchase exploits for zero-day or one-day vulnerabilities. Zero-day exploits target undiscovered vulnerabilities that software vendors have not identified and patched yet, while one-day exploits focus on systems that do not have the patch installed.

“Exploits can target any program, but the most desirable and expensive ones often focus on enterprise-level software. These tools enable cybercriminals to carry out attacks, which equate to substantial gains for them, such as stealing corporate information or spying on an organisation undetected.

However, some exploit offers on the dark web may be fake or incomplete, meaning they don’t function as advertised. Additionally, a significant portion of transactions are likely to occur in private.

These two factors complicate the assessment of the actual market volume for functional exploits,” explains Anna Pavlovskaya, Senior Analyst at Kaspersky Digital Footprint Intelligence.

The dark web market offers a wide array of different types of exploits. Two of the most widespread are those for RCE (Remote Code Execution) and LPE (Local Privilege Escalation) vulnerabilities.

According to an analysis of over 20 listings, the average price for RCE exploits is around $100,000, while LPE exploits typically cost about $60,000. RCE vulnerabilities are considered more dangerous, as they allow attackers to take control of a system or its components, or confidential data.

Dark web listings for buying and selling exploits, 2023-2024, where some offers can be repetitive. Source: Kaspersky Digital Footprint Intelligence

This year, the peak level in exploit sales and purchases occurred in May, with 50 relevant posts, compared to an average of about 26 per month in the period surrounding the surge. “Peaks in the exploit market’s activity are unpredictable and hard to link to specific events.

“Interestingly, in May, the dark web witnessed the sale of one of the most expensive exploits during the analysed period – allegedly, for a Microsoft Outlook zero-day vulnerability priced at nearly two million US dollars,” elaborates Anna Pavlovskaya.

“Overall, the exploit market remains stable; while activity fluctuates, the threat is always present. This highlights the need for cybersecurity hygiene practices, such as the regular patching and monitoring of digital assets on the dark web.”

Spotify Premium users no longer need to suffer in silence when they’re offline and have forgotten to download tracks or playlists in advance.

The streaming music company says it’s adding an Offline Backup feature that’ll automatically display a playlist of available tracks that can be played offline even if they weren’t manually downloaded.

The feature will start rolling out this week on iOS and Android apps, and will work with Android Auto and Apple CarPlay, according to Spotify.

The company noted that the feature might be useful for people who are boarding a flight with no internet connection and realize they haven’t downloaded any music in advance.

Spotify says the playlist will be generated from tracks that are already in the user’s data cache, so it presumably wouldn’t take up additional storage space on a mobile device.

The playlist will show up when a user is offline, and can be filtered and sorted by artist, mood and genre.

The Offline Backup playlist changes over time and can be added to the user’s library for easy access.

The number of tracks in the playlist will vary based on how frequently subscribers use Spotify. Some Offline Backup playlists will contain hours of music.

Though the Offline Backup playlist hasn’t shown up yet on the Spotify Home feed on my iOS device, an option in settings for “Offline listening” under Storage was enabled by default.

Users have the option to remove downloads or clear their cache, but that could disrupt the playlist.

In order for offline listening to work, Spotify said, users should’ve listened to at least five songs recently.