Your hypothesis is based on an incorrect assumption of how the process works. AT&T sends the request to Apple - Apple adds IMEI to a whitelist. When said iPhone is plugged into iPhone, it sends a request to Apple for an activation ticket. If the iPhone's IMEI is in the whitelist, Apple responds and gives an activation ticket with the "unlock code" embedded in it.
That is exactly the way I've always understood the official unlocking mechanism to work, ever since the descriptions started rolling out a few years ago from the first European and Australian service providers to offer this capability. I promise you, this is not news to me.
There's nothing to intercept, because the query sent from the local computer is the same whether or not the phone is unlocked. If you had access to whatever computers AT&T sends the requests from, then you could probably figure out how to spoof an official looking request. But at the same time, if you had access to those computers, you could probably have just sent a request yourself.
Hypothetically speaking if you were able to obtain the 40-bit key that the baseband looks for to unlock itself, then yes, you could have something that sits between Apple and iTunes, and send the unlock that way. But getting that key is not a simple matter.
To be absolutely clear, I
was proposing that this hypothetical interception program would have sat between Apple and iTunes. I was
not porposing that it would sit between Apple and AT&T.
I
was proposing that it would have hypothetically impersonated the Apple server on which the official whitelist was hosted, and to which all iTunes "phone home" queries were submitted.
I
was proposing, therefore, that whenever iTunes attempted to query Apple's servers to find out whether or not an iPhone was on the whitelist, this program would have created an impersonated response (instead of Apple's servers), instructing iTunes that the phone was legitimately unlocked.
I
was proposing, therefore, that this hypothetical solution would have required some way of obtaining the 40-bit key.
To be even more clear, I was
not proposing that such a solution was practical, or even that it was possible.
I was simply pointing out the fact that, independently of whether or not anybody ever actually managed to figure out how to make it work, anybody who used the hack would have to remember to keep the hack forever, and to always perform all their iTunes syncs using a machine that is running the hack all the time, or else a "real" response from Apple's official server might manage to accidentally slip through and re-lock the phone.
