If you read about cell phone tracking it looks an IMSI Catcher always uses a fake base station the get the phones IMSI. I don't understand why this is necessary.
Couldn't they just passively read the signal and copy the phones ID from it's communication?
From what I read the signal might be encrypted but can be broken in real time. So why the trouble of faking a complete base station.
IMSI Catchers are fake mobile network cells (BTS) and additional equipment for call routing that operates in a "evil twin attack" and MiTM manner. They are usually positioned in places nearby the victim, where their signal is stronger than the signal of the legitimate network service provider cell, so the victim phone choose the fake BTS than the legitimate one. When the phone try to negotiate the encryption scheme with the specific for the GSM protocol handshake procedure, the IMSI Catcher identifies the victim by it's IMSI and downgrade the required cryptography from A5/1 or A5/2 to A5/0 or "not encrypted". It basically tells the victim phone "i can't support anything but A5/0". When the phone starts to communicate with the IMSI Catcher and traffic channel is allocated for that client, all communications can be sniffed on the traffic channel, because there is no encryption. Next, with the permission of the network service provider to access their HLR, the communication is encrypted with the subscriber master key, and routed through the network. This way, we can have two-way communication without the victim knowledge about the surveillance actions.
This can't be done without physical BTS, since it needs to receive and transmit on the RF media.
I agree on the fact that to catch ( to know) IMSIs you don't necessarily need a physical base station, provided you can hack into the core network and exploit signalling protocols such as Signalling System no. 7. With SIP/VoIP protocols and hence the amalgamation of IP world with Telecom world, the core network is no more a walled garden. Getting access to core network have been relatively easy than before.
For example, you can use the following signalling protocol message to fetch the IMSI given that you have victim's phone number.
For more details, read the section 4.2.3 of this thesis.
However, SS7 attacks to know IMSI could be much more expensive than having a fake base station yourself. You can build (I would not recommend it) your own handheld base station using Yate openBTS. One such recent update on IMSI catcher can be seen from this from Blackhat Europe.
