It's not impossible, large carriers are still using DES to sign the OTA updates. Using rainbow tables you can crack the key and install an app which can break out of the sandbox and read the ki and IMSI.