I just watched an interesting talk from Glen Glenn Wilkinson titled: The Machines that Betrayed their Masters. 

He said that your phone is constantly broadcasting all the SSIDs it has ever connected to. How would an attacker be able to capture these wifi requests?

Fairly easy to be honest, all you need is to do is listen for Probe Requests. There is a nice blog explaining how to go about setting up a computer with BT5 to listen for them here.

With a networking card that supports "Monitor mode", you are able to pick up so called "Probe requests". Once the networking card is set up to be in monitor mode you can use something like aircrack, wireshark or hoover to capture the probe requests.

For example when using ubuntu and wireshark, set the network card in monitor mode:

sudo ifconfig wlan0 down
sudo iwconfig wlan0 mode monitor
sudo ifconfig wlan0 up


Now start wireshark and set the filter for "wlan.fc.type_subtype eq 4".

That's it, now you can see all the SSIDs being probed for around you.
