What it does is measure the signal strength of WiFi, 3G and GSM Base Stations/Access Points in the area. Since all WiFi access points have a unique MAC address, and 3G and GSM Base Stations also have unique identifications, it now knows which base stations you are close to and approximately how close to them you are, based on the strength.
There are now a few ways to find the distance. If it knows where the Access Point/Base Station is, then it can triangulate your position, based on the signal strength. For this to work it needs to have access to at least 3 AP/BS. With GSM it can also use the Timer Advance, which is an estimation of how far away you are from the base station, with an accuracy of approximately 1km. With 3G it's even better.
Another approach (used by Google and others) is that all your signal strength data is sent to a server. If you have a GPS then your GPS info is also sent along. The server can then build a map of signal strengths to different AP/BS at different coordinates. Since you don't have a GPS it now compares the signal strengths you have passed along and tries to find the closest match in its database, and then finds the location at that closest point.