[inflation]

It's part of the wireless spec that the SSID is broadcast in the clear via management frames.

All it takes is a NIC in promiscuous mode to detect them, and there are simple, point and click apps for all platforms that do this for you. Some of them even automate MAC address cloning.

[antiRepublicrat]

Some of them even automate MAC address cloning.

I like what they came out with at BlackHat. It deauthenticates current users and grabs the SSID and MAC from the users when they try to reconnect. Why meddle with management frames when the clients themselves can tell you everything? Then you just clone and you're off and running.