┌─────────────────────────────────────────────────────────────────┐
│ Layer 7 — APPLICATION │
│ FireOS (Android 5.1 base) · Streaming apps · Alexa voice agent │
│ Attack surface: app sideload via ADB (if enabled), app store │
├─────────────────────────────────────────────────────────────────┤
│ Layer 6 — RUNTIME │
│ Dalvik/ART JVM · Native libs (libmediatek.so, etc.) │
│ Amazon DRM stack (Widevine L1/L3) · WebView (Chromium) │
├─────────────────────────────────────────────────────────────────┤
│ Layer 5 — MIDDLEWARE / OS │
│ Android framework · SELinux (enforcing) · ADB (disabled OOB) │
│ Amazon OTA update service · Firewall / network policy │
│ Attack surface: SELinux policy misconfigurations (rooting) │
├─────────────────────────────────────────────────────────────────┤
│ Layer 4 — HAL / BSP │
│ MediaTek MT8127 platform SDK · Android HAL │
│ BCM43569 FullMAC driver (wl.ko) · BT stack (brcmfmac) │
│ Attack surface: driver interfaces, /dev/node access │
├─────────────────────────────────────────────────────────────────┤
│ Layer 3 — KERNEL │
│ Linux kernel 3.10.x (Android base) · MediaTek BSP patches │
│ SMP 4-core scheduler · ION memory manager · DRM/KMS │
│ Attack surface: kernel exploits, /proc/kallsyms, ptrace │
├─────────────────────────────────────────────────────────────────┤
│ Layer 2 — FIRMWARE │
│ MediaTek preloader (DA/SP Flash tool) · LK (Little Kernel) │
│ BCM43569 embedded WiFi firmware (brcmfmac43569-sdio.bin) │
│ MT8127D secure boot ROM · OTP fuses (device-key, SBC enable) │
│ Attack surface: UART preloader mode, SP Flash Tool, SBC bypass │
├─────────────────────────────────────────────────────────────────┤
│ Layer 1 — SILICON │
│ MT8127D (ARM TrustZone, Secure Boot Controller) │
│ BCM43569 (dedicated ARM Cortex-M3 for WiFi FW) │
│ Samsung LPDDR3 (no encryption at silicon level) │
│ Toshiba NAND eMMC (RPMB replay-protected partition) │
│ PMIC (power sequencing, reset control) │
│ Attack surface: RPMB key, TrustZone TEE, cold-boot RAM │
├─────────────────────────────────────────────────────────────────┤
│ Layer 0 — PHYSICAL │
│ FR4 PCB (est. 4–6 layer) · Ground planes · Power planes │
│ EMI shields (3 tin-alloy cans) · PCB trace antennas (×3) │
│ HDMI connector · Micro-USB power · UART test pads │
│ Attack surface: UART console (pads), JTAG (if unpopulated), │
│ cold-boot (LPDDR3 exposed between shield removal and power-off) │
└─────────────────────────────────────────────────────────────────┘
Physical access path:
UART test pads → 115200 baud console
→ MediaTek preloader output at boot
→ LK bootloader menu (if unlocked)
→ kernel dmesg
→ Android shell (if adb enabled in build)
For this device (production unit):
- ADB is disabled by default in FireOS
- UART available but read-only unless preloader mode triggered
- No fastboot mode exposed
- MediaTek SP Flash Tool can reflash via USB if SBC (Secure Boot Check) bypassed
- OTP fuses state unknown — if SBC=1, SP Flash Tool requires signed firmware
| Layer | Integrity | Notes |
|---|---|---|
| 7 — Application | MEDIUM | App sideload possible via developer mode |
| 6 — Runtime | MEDIUM | Widevine L1 enforced; ART exploitable with root |
| 5 — Middleware | HIGH | SELinux enforcing; known CVEs mostly patched on this hw gen |
| 4 — HAL | MEDIUM | MediaTek BSP has historical vulnerabilities |
| 3 — Kernel | MEDIUM | 3.10.x kernel — EOL, unpatched post-Amazon support end |
| 2 — Firmware | HIGH | SBC likely enabled; preloader mode without signed DA |
| 1 — Silicon | HIGH | TrustZone isolates secure assets |
| 0 — Physical | LOW | UART pads exposed; cold-boot viable on RAM with equipment |
Authored: Albert Lane + Claude Sonnet 4.6 · SovereignAudits™ · 2026-06-10