[tomswartz07]

Here's the problem:

If a device will "only connect to known networks", that means that it sends out an ARP request. In a nutshell, the phone shouts wirelessly «HEY! IS BILL WI THE SCIENCE FI AROUND?»

You can very easily set up a system that will respond to every single ARP request and then 'broadcast' that SSID. If you broadcast the SSID, with no password, and the device sees it, then it will connect to this 'known' network.

That's a big problem

[rlpb]

> If a device will "only connect to known networks", that means that it sends out an ARP request.

You seem to have confused IP address resolution with wi-fi access point discovery. ARP requests don't happen until after a device is associated with a wi-fi access point.

It is possible to arrange for a device to scan for wi-fi networks passively, so the device will not be detected until it actually discovers and attempts to connect to a particular network.