China Said to Probe U.S. Claim of N. Korea Role in Sony Hack

China has started an investigation into a possible North Korean role in the hacking of Sony Pictures Entertainment following a request from the U.S. government, according to a person with direct knowledge of the matter.

The foreign ministry will cooperate with other Chinese agencies including the Cyberspace Administration to conduct a preliminary investigation, said the person, who asked not to be identified because the probe hasn’t been made public. The decision was made after U.S. Secretary of State John Kerry spoke by phone on Dec. 21 with China’s Foreign Minister Wang Yi.

The dispute between the U.S. and North Korea is escalating after hackers forced Sony to pull a comedy movie about the assassination of North Korean leader Kim Jong Un, exposed Hollywood secrets, and destroyed company data. After President Barack Obama promised the U.S. would respond proportionately, North Korea warned on Dec. 21 that any punishment would lead to damage “thousands of times greater.” North Korea denies it was behind the Sony attack.

North Korea’s limited access to the Internet has been cut off, according to network-monitoring companies.

The nation, which has four official networks connecting the country to the Internet -- all of which route through China -- began experiencing intermittent problems on Dec. 21 and on Dec. 22 went completely dark, according to Doug Madory, director of Internet analysis at Dyn Research in Hanover, New Hampshire.

DNS Attack

It appears to be suffering from a relatively simple distributed denial-of-service attack that is causing temporary Internet outages, said Dan Holden, director of security research for Arbor Networks Inc., based in Burlington, Massachusetts.

Asked about U.S. claims that North Korea used facilities in China to attack Sony’s computer system, Foreign Ministry spokeswoman Hua Chunying told reporters in Beijing on Dec. 22 that there is a need to gather facts before reaching any conclusion.

China is opposed to any country or individual using cyber-attacks against a third party by using facilities beyond its own borders, Hua said. China will deal with the matter in accordance with Chinese and international law, she said.

China needs to understand exactly what happened before it can take further action, the person familiar said.

Hacking Tools

Malicious software in the Sony attack bore links to malware previously used by North Koreans, according to the Federal Bureau of Investigation. The hacking tools used were also similar to those used in a March 2013 attack on South Korean banks and media organizations, it said.

U.S. administration officials told Bloomberg over the weekend that the country has already asked China to help in blocking its communist neighbor’s ability to carry out cyber-attacks.

The problem is “it’s not clear that the Chinese will help us here,” said Fran Townsend, a former homeland security adviser to President George W. Bush who spoke on ABC’s “This Week” program.

During the phone discussion with Kerry, foreign minister Wang said China is against all forms of cyber-attacks and cyber-terrorism, according to a post on the ministry’s website.

Wang’s remark means Beijing has “in principle” agreed to help the U.S., said Liu Ming, director of the Korean Peninsula Research Center at the Shanghai Academy of Social Sciences.

‘Relevant Intelligence’

“China would support the U.S. call for cooperation on the Sony cyber-hacking case; it could provide relevant intelligence,” said Liu. “What Beijing can do may be limited because China-North Korea ties are lousy, and Beijing doesn’t have as much sway over Pyongyang as is perceived.”

The sensitive nature of the incident also means Beijing will be cautious in any cooperation with U.S. authorities, according to Liu.

“It will create many problems if Beijing gets involved too much, because cyber-hacking is always a thorn in side in the Sino-U.S. relations and Americans accuse the Chinese of doing cyber-attacks,” Liu said.

Relations between Asia’s two Communist neighbors have become strained since North Korean leader Kim Jong Un took power in 2011. China has criticized Pyongyang’s nuclear tests. In the meantime, North Korea’s number two, Choe Ryong Hae, visited to Moscow in November and said the country is interested in forging closer ties.

China and the U.S. also have tensions over cyber security. The U.S. Justice Department in May indicated five Chinese military officers on charges of hacking American companies to steal sensitive information.

“I think Beijing will be level-headed about the case and should at least get to the bottom of it first before rushing to anything,” said Shi Yuanhua, director of the Center for Korean Studies at Fudan University in Shanghai.

The Cyberspace Administration of China didn’t respond to questions via fax seeking comment on Dec. 22.

— With assistance by Keith Zhai, and Ting Shi