Axis of Evil

China Is Reluctant to Blame North Korea, Its Ally, for Cyberattack
By PAUL MOZUR and JANE PERLEZ

HONG KONG — North Korea tests nuclear weapons less than 100 miles from China’s border. 

It launched a missile hours before a major speech by Xi Jinping on Sunday, a move Chinese analysts called a diplomatic slap in the face. 

Its counterfeiting of Chinese and American currency costs China millions of dollars a year.
North Korea’s history of erratic behavior has embarrassed China in many ways. 

But through it all, China has remained stoic about its neighbor and ally.
As evidence mounts that North Korea may have links to a ransomware attack that destroyed more than 200,000 computers globally — and hit 40,000 institutions in China — China’s response has been muted. 

Which raises the question: How far can North Korea go without getting disciplined by its powerful protector?
China has been one of the biggest victims of the attack, which crippled computers at universities, major businesses and local governments, adding a potentially dangerous new element to a relationship that has increasingly tested Chinese leaders.

“North Korea has been a constant threat in terms of missiles and nuclear weapons,” said Cheng Xiaohe, an associate professor of international relations at Renmin University. 

“All of a sudden, it poses a cyber threat.”

He added: “This time if it’s from North Korea, the malware was targeted indiscriminately against all computers. That’s a big change. It harms and threatens China.”
Amid these tensions, Beijing is not eager to call attention to its deteriorating relations with its longtime ally. 

North Korea’s missile launch took place hours before Xi addressed an international gathering in Beijing to promote China’s “One Belt, One Road” project — an enormous infrastructure undertaking that is expected to build projects in Asia, Europe and Africa.
Even though the timing of the launch suggested it was a deliberate ploy to embarrass Xi at an inopportune time, it was not reported in the Chinese state media.
Regarding the ransomware attack, China analysts say Beijing will hesitate before directly casting blame on North Korea even if evidence directly ties the North to the attack. 

Beijing is more likely to single out other actors, particularly the United States, experts say.
The attack took advantage of vulnerabilities in Microsoft Windows software through a tool stolen from the United States’ National Security Agency. 

That plays into broader Chinese concerns about its overreliance on American software.
China’s influence over North Korea’s hacking efforts has been significant. 

The idea to experiment with cyberattacks came to North Korea from China.
Initially, the North Korean government viewed the internet as a threat. 

But in the early 1990s, a group of computer experts returned from China with the idea of using the web to take secrets and attack government enemies, according to one defector.
Since then, North Korean hackers have attended schools in China and used it as a staging ground for attacks. 

As North Korea devoted more resources to those efforts — eventually selecting child math prodigies for training and assembling an army of more than 6,000 — it established a large outpost for its secretive hacking unit in China.
North Korean hackers operate out of hotels, restaurants and internet cafes in northeastern Chinese cities like Shenyang and Dandong, which are outposts for trade with North Korea. 

Though many still operate in China, North Korean hackers have increasingly moved further afield, to countries in Southeast Asia, where government surveillance and control is less strict.

An internet cafe in China. Around 40,000 institutions in China have been hit by a recent cyberattack.

The moves are also intended to protect cyberattack options in the event of a war on the Korean Peninsula. 

Security analysts say some attacks are also carried out from North Korea, but are limited by the fact that the country has only one main portal to the internet, through China’s state telecom operator China Unicom.
Despite evidence suggesting a North Korean role in the ransomware attack, the most common reaction among experts and on Chinese social media was to blame the United States.
“Many criticized the U.S. government, saying that it was responsible for this spread of ransomware. Obviously this accusation is reasonable,” the editor in chief of state-run Global Times wrote in a prominent commentary on Monday.
“Attacks always happen,” said Chen Zhong, a professor in computer science at Peking University. “What catches our eyes this time is that the attack used a tool that leaked from the N.S.A.,” he said.
On the social media site Weibo, users almost uniformly blamed the United States for the attack.
“Hell, if North Korea could do this they would have showed it off long ago,” said one user. 

“North Korea would have become a major power if they can pull this off,” said another.
But Cheng of Renmin University said that if events more definitively linked the attack to North Korea, it was likely to pose a new test to China’s increasingly rocky relationship with Pyongyang.
“Since North Korea started its nuclear program in 2006, China-North Korea relations have gradually deteriorated, and are currently at an abnormal level. If we add another virus, the image of North Korea in the eyes of China will be even worse.”
China’s news organizations, both state-run and private, reported on the hacking attacks, as well as the possible links to North Korea, hours after it occurred, but they did so in a controlled fashion that was confined to inside pages of newspapers, and played in modest ways on websites.
Still, several news portals wrote that cybersecurity firms like Kaspersky Lab had found initial evidence that pointed to North Korea. 

The news portal Sina pointed to previous attacks – in Bangladesh, against Sony and the South Korean subway – that may have originated from the North.
Should the evidence against North Korea mount, it would add to other indignities China has suffered at the hands of its neighbor.
Over the years, North Korea has flooded northeastern China with counterfeit $100 bills of American currency. 

It has also mass manufactured counterfeit Chinese renminbi, but China says little about the problem.
This year, South Korea accused the North of assassinating the half brother of the North Korean leader, Kim Jong-un, at the international airport in Kuala Lumpur, the capital of Malaysia. 

The relative, Kim Jong-nam, was considered a friend of China and he had lived in the Chinese-controlled territory of Macau, where he was protected by state security.
Chinese state-run media reported on the killing but refrained from associating Mr. Kim, the half brother, with China.
In 2013, an uncle of Kim Jong-un, who was the main financial conduit between China and the North, was executed by a firing squad that used antiaircraft guns, according to South Korea’s National Intelligence Service.
South Korean intelligence said the killing of the uncle, Jang Song-thaek, was ordered by Mr. Kim as he was consolidating power over North Korea. 

His death meant that China lost its most important interlocutor with the North, and was an early signal from Mr. Kim that under his rule relations between China and North Korea would not be business as usual. 

But China withstood the insult without public recrimination.