I have already described about Content Providers in Android Application Security Part 3- Android Application Fundamentals, please go through it if you haven’t yet.

To determine exported services, i will be using drozer.

So from the above we can see that there is an org.owasp.fourgoats.goatdroid.LocationService service which is exported and doesn’t need any Permission. So it means that any malicious app which is installed on the device with the FourGoats App can access the location of the device.That’s Dangerous

Let’s us try to Start particular Service

Below is the screenshot before i do not start the service.

Now i ran the following commmand

And observe that location sign in the status bar and GPS location is being accessed by FourGoats app.