# An Evaluation of the Security of Bare Machine Computing (BMC) Systems against Cybersecurity Attacks
A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administrative operations on the database (such as shutting down the DBMS), recover the content of a given file present on the DBMS file system, and in some cases issue commands to the OS. 17. Supply Chain: A supply chain attack [24] is one in which many vendors in the chain are rendered vulnerable when a single vendor is compromised. The attackers can obtain maximum benefit by concentrating their attack on a single vendor and then gain access to global data through the chain of connected vendors. A supply chain system consists of many vendors for a given customer. If one of the vendors is breached or attacked in the chain, it may influence other vendors. One of the vendors may have been breached due to security vulnerabilities in their site. When there are many suppliers, one or more of them may be prone to security vulnerabilities. Multiple targets can be compromised from a single vendor. 18. URL Interpretation: URL interpretation [25] exploits the vulnerability of URLs by changing and manipulating the URL meaning without changing or altering the syntax, which allows the attackers to access unauthorized data from the server associated with the URL. Attackers can alter and fabricate URL addresses to access victims' private data and information. It is also known as URL poisoning. An attacker may use this fake URL to gain administrative privileges and launch other attacks. 19. Insider Threat: Insider threats [26] happen when employees within an organization have privileged access to critical information and misuse their credentials for personal gain. This could render the organization system vulnerable to security attacks. These employees may have current credentials to access private data at an employer site. They may be seeking financial gains to extort the employer using the accessed private data. 20. Eavesdropping: Eavesdropping [27] is stealing transmitted information over an unsecured network. It consists of capturing network traffic. The attacks can be static or modification attacks. In static attacks, the data may be used later to capture valuable information. In modification attacks, the data are only useful if an attacker can modify it while the communication is in progress. A MitM attack can be used with the captured data. 21. Cookies: Cookies contain information about a machine, sites browsed, clicks made, location, and possibly login information [28]. Attackers can steal or hijack a cookie and capture this data. When a user visits a website, cookies may be enabled to play advertisements and capture the user's browser activity. Although cookies help speed up access to visited websites, they help attackers piggyback malicious programs along with legitimate ads. 22. Social Engineering: These attacks [29] are used to convince a victim to share private data or perform some actions that will enable an attacker to inject some illegitimate code into the system. This is one of the ways attackers can install malware on the victim's site. There are many standards that classify security vulnerabilities and cyberattacks. With respect to these standards, such as CVE [30], CWE [31], and MITRE ATT & CK [32], their root causes and mapping to attacks are based on current systems, products, and software engineering methodologies. Bare machine computing is a different concept and approach. In this paper, we only consider generic attributes that can be compared with the BMC paradigm and its applications. To provide a comprehensive evaluation of the BMC paradigm, we chose to compare conventional systems and BMC systems. First, we identify and discuss conventional system guidelines and conventional system characteristics. Next, we give an overview of the BMC paradigm, the compilation process in BMC development, and the integration of direct hardware interfaces in BMC code. We include code snippets that give insight into how BMC applications directly control the hardware.