User$-$Mode$-$Linux $($UML$)$ is an open$-$source tool used to create virtual machines. It's efficient for deploying honeypots. One of the big issues with UML is that it doesn't use a real hard disk, but a fake IDE device called $/$dev$/$ubd$*.$ How can an attacker find a UML system?

answer

Attackers cause an illegal instruction, then watch how it is handled.

Attackers look for specific video cards, display adapters, and network cards.

Attackers detect a honeypot by measuring the execution time of the read$()$ system call.

Attackers need to take a look at the $/$etc$/$fstab file or execute the mount command.