I agree on the fact that to catch ( to know) IMSIs you don't necessarily need a physical base station, provided you can hack into the core network and exploit signalling protocols such as Signalling System no. 7. With SIP/VoIP protocols and hence the amalgamation of IP world with Telecom world, the core network is no more a walled garden. Getting access to core network have been relatively easy than before.
For example, you can use the following signalling protocol message to fetch the IMSI given that you have victim's phone number.
- MAP_SENDROUTING_INFO_FOR_SM (of SMS procedure)
- MAP_SENDROUTING_INFO (of call setup procedure)
- anyTimeInterrogation request
For more details, read the section 4.2.3 of this thesis.
However, SS7 attacks to know IMSI could be much more expensive than having a fake base station yourself. You can build (I would not recommend it) your own handheld base station using Yate openBTS. One such recent update on IMSI catcher can be seen from this from Blackhat Europe.