Group-IB has released a report on the results of an audit of audience voting in the show "The Voice. Children-6"

The international company Group-IB , specializing in the prevention of cyber threats, published an analytical report based on the results of a study of audience voting in the finale of the 6th season of the television show “The Voice.Children,” which ended in a major scandal . The company's experts confirmed the conclusions about the use of vote fraud, and also identified a number of anomalies that accompanied the voting.

In less than a month, Group-IB completed all procedures related to the independent investigation initiated by Channel One. The report published on the company's website reflects the progress of the verification of voting results at each of its stages. The work of the specialists began with putting forward hypotheses to explain the significant gap between the project’s contestants in the final, which took place on April 26 live on Channel One. To confirm or refute each of the hypotheses, a cross-functional project team was created, whose experts worked in three areas: system security audit, data collection and computer forensics, as well as technical data analysis.

The report contains the official position of Group-IB regarding the current situation. "Group-IB specialists conducted an independent technical study, and its results are not intended to draw incriminating conclusions towards any of the participants in the Voice.Children project. Group-IB is categorically against the use of data from the report to assess the ethical side of the issue or accusations directed at children or their parents,” the company emphasizes.

At the first stage of the investigation, Group-IB experts discovered two groups of numbers from which votes were cheated. According to updated data, in total more than 41 thousand votes were received from these numbers for participant 07.

Let us recall that among the IVR calls (Interactive Voice Response - answering machine voice menu) in favor of participant 07, a group of numbers following one another was discovered. All of them belong to the Bashkiria region and are lists of consecutive telephone numbers. Each list contains up to 360 numbers, a total of 146 such lists. In total, 9,484 numbers were involved in the promotion, from which 33,175 calls were received for participant 07.

The second group, used in cheating, was identified during the analysis of SMS. The text of 8,216 SMS, in addition to the number of one of the competition participants, by mistake of the performers included technical information containing an additional number and departure time. This group of numbers also belongs to one operator in the Leningrad region.

At the second stage of verification, Group-IB specialists excluded from the analysis both groups used for cheating and continued to study the voting process. Further, the company’s specialists divided the voices received through SMS and telephone calls (IVR), since they have technical differences and require different approaches to analysis.

A detailed study of voting in the final (9 contestants) and super final (top three) showed an uncharacteristic distribution of the frequency of votes over broadcast time. The attention of experts was attracted by the sharp start of voting for participant 07 (Mikella Abramova performed under him), accompanied by a high density of calls and SMS from the very beginning of the performance. In the final, where out of three students one gets into the super final, up to 300 votes per second were received for participant 07. Among rivals, this figure, on average, reached 110 votes per second. In the super final, participant 07 received 250 votes per second, while his opponents received 170 (participant 06) and less than 100 (participant 02).

Separately, experts studied the voting of subscribers who cast 20 or more votes for their favorites. The distribution of such votes goes beyond the statistical error: participant 07 had 2,078 such subscribers. “Maximalists” also voted for other contestants: one had 39 such fans, the other 59, that is, approximately 35 times less than participant 07 .

As a result, the average number of all votes cast from one phone for participant 07 is close to 8, with the average value for the remaining participants being about 1.5. Since 2015, for all seasons of the show "The Voice" in Russia, including adult and children's projects, on average, this figure was 1.33. Such a record allowed participant 07 to gain more votes in total, but the number of unique numbers who voted for him compared to his closest rival, who took second place, was 2 times less in the final and almost 6 times less in the super final.

IVR's share was less than 10% of total votes, so the main study focused on SMS. To further identify anomalies, Group-IB specialists excluded the pool of “technical SMS” of the Leningrad region from the analysis, however, given that this cheating was discovered due to a technical failure, it is possible that there could be more such “SMS pools”.

“Cleared” SMS traffic shows a significant excess of the average number of votes from one number cast for participant 07. This trend can be seen in both the final and the super final. If we analyze SMS traffic separately for each super finalist, then the main share of votes (63% for participant 02 and 60% for participant 06) falls on those who sent one SMS, 12% and 14% - two, 7% and 8 % - three. For participant 07, the distribution is actually in the reverse order: the share of votes received from numbers sending 20 SMS is 70%, 19 SMS - 5%, two SMS - 1%.

The analysis of the final is identical: the main share of votes (80% for participant 02 and 75% for participant 06) falls on those who sent one SMS, 8% and 12% - two, 4% and 5% - three. Participant 07 again has an advantage in the share of votes received from numbers that sent 20 SMS (75%), 19 SMS - 3%, two SMS - 1%.

Traditionally, the leaders in voting activity are Moscow and St. Petersburg. However, this time the balance of power has changed. Taking into account all types of votes cast during the finals and super finals of the 6th season of the show “The Voice.Children”, the top 10 most actively voting regions were: Moscow (71 thousand), Bashkiria (35 thousand), St. Petersburg (29 thousand), Kursk region (12 thousand), Tatarstan (7 thousand), Krasnodar region, Rostov region and Ulyanovsk region gave 6 thousand votes each, as well as Voronezh and Samara regions gave 4 thousand votes each.

The distribution by region shows deviations in the percentage of votes cast for participant 07. This is especially pronounced in Bashkiria - 97%, Kursk - 96% and Ulyanovsk region - 95%.

There was no hacking of the voting system

Group-IB auditors examined the voting system from various aspects, including network architecture, device configuration settings, and administrative distribution of roles in the team. Also at the audit stage, various scenarios and attack vectors were tested: during the simulation of attackers’ actions, the main goal was to check the possibility of modifying voting results.

A comprehensive study of the infrastructure, website and web application made it possible to identify a number of vulnerabilities characteristic of modern web services and networks. Potentially, they could be used by an external attacker who is highly skilled in hacking applications and systems. However, as the first and subsequent stages of analysis showed, this did not happen. All audit data was promptly transferred to the aggregator company, whose specialists included some of the recommendations received and continue to work to strengthen the security of the system.

Computer forensics experts examined 5,711,169,746 bytes and more than 30,000,000 lines in the logs. They were tasked with identifying facts of possible changes in voting data by authorized and unauthorized users, as well as attempts to deliberately make changes to settings that create conditions for external influence in order to change voting results. In addition, at this stage it was necessary to restore destroyed data, if such operations were carried out, as well as check the analyzed systems for the presence of malicious code or software bookmarks.

As a result of a forensic investigation of the servers, services and website that constitute the vote recording system, no facts were found indicating unauthorized access to the system, as well as the deletion or modification of information by employees of the aggregator company or third parties. It was also confirmed that the vulnerabilities discovered by the auditors were not exploited. Thus, the version of possible interference in voting by various types of attackers was refuted.

Let us remind you that following the results of the final of “The Voice. Children”, shown on April 26, the daughter of the singer Alsou and a banker, as well as the granddaughter of the former top manager of Lukoil Mikella Abramova, not being the favorite of the season and remaining in the project thanks to the audience votes, sensationally won, gaining 56.5%. This outraged viewers, and Channel One decided to conduct an investigation.

An international company, Interpol partner Group-IB, hired for this purpose, revealed that votes were cheated in favor of Abramova. As a result, Channel One canceled the voting results and, in a special edition of the re-final, which Mikella Abramova did not attend, announced all the finalists of the sixth season of the show as winners. They all received a million rubles and the opportunity to record a song in the Universal Music studio.

Mikella Abramova donated the million rubles she won to the Angela Vavilova charity fund for children with leukemia in Tatarstan. She also said that she will continue to make music and wants to become an artist. “I’m ready to overcome difficulties. I realized that if I want to perform on stage, I have to be strong, do my thing and not pay attention to conversations,” said Michella.