Beagle
Don't worry, I don't do this for a living
All I did was put my PDA into its hands-free kit (normally it's running road nav software, which for £100 enables me to drive blindly to any address anywhere in the UK without any effort except driving the car), start up one of the above mentioned programs, and drive along the road at 30mph.
The thing is pinging away every 500ms and every time it sees an access point it logs it, optionally together with its GPS position. If I was a proper SOG (sad old git) I would then contribute this data to one of the databases of open access points.
I don't think PC Plod would know what this was if it bit him on the nose.
The program would even run in the background with the mapping software running on top. But the two can't share the GPS - a real shame, isn't it
I work in electronics which is how I know about it. The reality is that anybody who takes the trouble to read Personal Computer World on the train for half an hour every month will also know about it.
Getting back to the original subject, a well known lawyer wouldn't last more than a week without being the subject of a professional operation. There are LOTS of people who do this for a living, and it is the easiest thing to do. The directional aerials in particular are very cheap and make it easy to do this from a distance. FAR easier and safer than tapping a phone, especially a mobile one. The great thing is that if somebody is printing from a wifi-connected computer to a remote printer, the listener gets the full print data too. Great for getting copies of a lawyer's correspondence with clients who are not on fax or who don't want to use fax/email because the matter is too sensitive.
But you don't have to be a lawyer. It is virtually certain that any neighbour also running wifi will quickly discover that there is another network nearby. If he is honest he will ignore it. If he isn't.....?? Running a wireless network is like saying to neighbours "hey, I have some potentially confidential data here, and I bet you can't read it". Turning off SSID broadcast will solve that (often at the cost of creating hassle setting up new network connections especially if using encryption) but it won't stop somebody targeting somebody deliberately.
I run my wifi LAN with SSID disabled, with an access list containing just the laptops that should have access, and with WPA/PSK/TKIP. Only the last bit actually does anything for security; the others just remove the open invitation to the neighbours and to anybody driving by with their wireless-enabled laptop on the car seat. There are no plausible attacks on WPA/PSK in the public domain. The router is a Draytek 2900.
The other thing to appreciate is that - short of additional hardware - anybody who gains access to the wifi access point also has access to your internal network. The XP firewall won't protect you if somebody can login as a guest for example. The firewall in the router will do nothing - it works only on the internet port.