I'm wondering what, if anything, can be done to thwart the sort of attack described below. First, you can assume the following:
(1) There are several devices in your home which you have deliberately connected to the Internet, for example your phone or your laptop. These devices are all running operating systems guarded by strong passwords. In other words, in the spectrum of information systems security, they constitute a low risk.
(2) All these devices connect to a router. The router is also secured by a strong password and is free of any known vulns.
Then, let's say you buy a new device. This device is not provided with your router password, any may not even advertise any networking capability, for example, a mouse.
However, security is only as strong as its weakest link.
With that in mind, you live in an urban area populated by wifi connections. Most of them were installed for people with no clue about security and by companies who want to exploit their ignorance. It's a good assumption, then, that a significant number of those SSIDs are associated with weak passwords, for example, the 7-digit phone number linked to the DSL line.
Imagine, now, that this new device you bought wants to upload your life somewhere, in whatever form of data might be useful to an attacker. All it has to do is crack one of those neighboring wifi connections, which is easily done because, hey, that TV is going to be sitting in your living room for years, with nothing better to do while in a low-power state than comb through a cracking dictionary and hack into any wifi it can see. It could round-robin through SSIDs, trying password after password. It might well succeed within a month, in a typical urban setting, based on what we know about the rapidity with which weak passwords can be cracked, even in the absenece of a GPU array with suspiciously high power consumption. (I'm thinking of a commodity microprocessor quietly churning away for months or years on end.)
This is an even more serious problem if one considers open wifi. While there might not be any in your vicinity, at some point, that new TV or whatever is going to be moved across town. Enroute, it could find an open wifi connection and talk to it just long enough to upload the highest-value cargo stored within its flash. A cheap supercapacitor could suffice for the energy to do so.
If you bought that TV with any credit card, or probably even with Bitcoin, your ID is all over it. Not that we need that, of course. There will be plenty of photos of your private documents from months of photography, audio recording, key logging, or whatever.
You get the idea.
As you have probably gathered, my question has nothing to do with how to secure one's router. Rather, I want to know how I can detect, let alone prevent, evil IoT devices, or even rogue pencil sharpeners, for that matter, from connecting to the least secure locally visible wifi, especially when they might connect only rarely.
I guess you need some sort of wifi sniffer that dumps the air to an SSD or USB stick 24/7, so you can periodically dump it for analysis. It would be nice to know an easy way to do that, ideally buy kit X from company Y. (Yeah the sniffer itself is untrusted, but at least you could isolate it in foam packing or something.)