
GL   ooW! CAMA.PHREAKING                                                                                          This file was written on 3/15/93. 
It is strictly for informational purposes and should not be construed as a condonement on the author's part to the acts herein described.
Any and all use of this information is strictly at the readers' discretion. The author does not take responsiblilty for any action arising out of the use of the information herein.

CAMA Phreaking

What is it?
Phirst off what CAMA stands phor is Computerized Automatic Message Acounting.
What CAMA does is recognize your phone # when you dial your local Bell operator. This is how the operator knows what number you are dialing 
phrom(That an ANI). 
What is CAMA phreaking?
 It's a method of phreaking that circumvents the CAMA computer and allows you to make phree Long distance calls ( actually they get charged to another number more on that later.).

Now a short history on how I phound out about it.
About phive years ago I was searching phor Loops using a little program I had written phor my Apple ][e and hayes 1200 smartmodem.
I was scanning the phirst hundred numbers in various prefixes looking phor the telltale sound of a loop end (1000 hz).
This program I had written allowed me to make notes after my modem dialed a number and I heard what came on the line.
Well this one day I heard this after my program dialed 664-0064:

"Hello, Pacific Bell."

" Hmmm", I thought," that sure sounds like an operator."
So I got on the phone and said "am I dialing phrom this number?(my home phone )" The operartor said that she didn't know what phone I was dialing phrom because my number didn't show up on her screen.She punched in my home phone and the computer didn't accept it! Yes! So I did some experimenting and phound out that I could give her a bogus number, but that the number needed to start with the same prefix as the number I used to call her ie:bogus number = 664-xxxx. I also phound out that if I used prefixes that were in the same area as the original those would work too ie:665,667,795.
 
To describe how this works I'll give a little demo.


These are the givens:

You are dialing phrom your home or some other phone # (maybe a payphone)
phor example purposes we'll say you're dialing phrom 544-3225.
You've dialed the operator using the seven digit number.
phor example purposes let's just say that number is 664-0064.
The operator answers:

operator: Blah Blah Bell, may I help you?
you: yes operator I need dialing assistance.
operator: I need the number you are dialing phrom it's not registering on my computer.
you: Oh, maybe that's why I can't dial out. Well the number I'm dialing phrom is 664-XXXX<--(notice that the bogus number you are giving her starts with the same prefix that you dialed to get to her) ( and the last phour digits you selected at random-->always!)
operator: Ok, what number do you want me to dial?
you: 415-your-phavoriteBBS
operator: What happens when you dial?
you: I didn't get a ring when I dialed direct.
operator: hmmm, ok I'll put the call through phor you at the direct dialed rate.
you:(waiting to hear the carrier) (as soon as you hear the carrier say,"thank you operator") and you should hear her click off.
you: (at this point you'll have typed ATX1D (phor blind dialing--> at least on hayes and hayes compats) and hit return. Then you are online.

Now how did that work?
Well when you called the operator using the seven digit # her computer didn't pick-up your number and now her computer will accept any phone number that starts with the prefix that you used to dial her. ie: 664-xxxx

You saying to yourself now,"self, where do I get one of those access numbers?" Simple: you've got to hack'em. 
The way I phound mine was with a little program that I made to search phor loops .
Essentially you are doing the same as searching phor computers with your modem except--> you have to listen to your modem and hear what comes on the line.
My program was such that I could type little notes after I heard what came on the line. 
Remember: the example access number I gave was 664-0064 <-- the last phour digits started with 00.
You're going to search as many prefixes in your calling area that go phrom 
XXX-0000 to XXX-0099 and XXX-9900 to XXX-9999 as you need too until you hear either: 
"Hello, this is Pacific Bell.", or
"Hello, AT&T. "<--- yes I phound  an AT&T operator once but I gave that access number to a phriend to dial with and he gave the access number as the number he was calling phrom and that number died. (I haven't phound an AT&T CAMA since) What this means is that once you phind one of these be carephul and don't give it out!

Now you're saying to yourself,"self, that's phine an dandy but I want to call Long Distance outside of my local Bell companies' calling area."

Well I've got good news phor you.
Because of all the hoopla surrounding the access to long distance carriers Pacific Bell and other Bell companies (I think) can now put you through to the Long distance carrier of your choice. ( consumers phind it easier to do this than to phind out the long distance access code. ie: 10ATT(288) phor AT&T and 10333 phor sprint) 

So with that in mind here's another example of a conversation between you and the operator:
Dialing the 664-0064 number your reach the Bell operator.

Opertor: Blah Blah Bell, may I help you.
you: yes operator can you connect me with AT&T?
operator: certainly hold on a sec.
AT&T: This is AT&T, how may I help you?
you: I not getting a ringing sound when I dialed this number would you dial it phor me?
AT&T: sure, but phirst I need the number you're calling phrom.
you: oh, it's 253-xxxx <---(notice: since the Bell operator didn't ask you phor your phone number you can give out a bogus number that starts with about any prefix in your area code.) (I've phound that occasionally a number that I give the operator starting with a certain prefix won't work so then I say ,"Oh, I must've given you the number phor my other line ",and I give a number starting with a prefix that does work.
Now if the Bell operator got a bogus number phrom you the AT&T operator will show that number on her screen and she won't ask you phor it.
Also,  if you ask phor Sprint or MCI phrom the Bell operator and she doesn't get your bogus number you won't get connected to those long distance carriers.
You'll either get an error recording such as, "We're sorry but you long distance service has been temparaily disconnected" or the LD operator won't be able to hear you.

Here are some notes to keep in mind:

1. The access number will not work phrom outside your area code. Don't even experiment with it. I did this and lost the 664-0064 number I described bephore.
I guess that if the access number shows up on a bill (where it shouldn't) a phlag is dropped.

2. Always use random bogus number (if you use the same bogus # over and over the phone co. will see a pattern. And probably catch you)

3. Don't use this to call voice unless the person you are calling is K00L like that. My brother used to live about 200 miles away phrom me and I'd call him a lot using this technique and he got calls phrom PAC-Bell billing and an Irate customer wanting to know who he knew in my town.

4. Don't share this with too many people your number may die. Also the more that know the more likelyhood the number will die.

5. Also it's a good idea to not make a lot of calls in a row using this tech. I've done that and the operators began to recognize my voice.(not good)

6. If phor some reason it takes the opertor a long time to make the call hang up and try again. 

7. You might consider making a voice altering device to change your voice everytime you call(make it higher and sound like a girl, make it lower and sound like a guy)phor the opposite sexes of course.

8. Also I'm not sure how safe this is. My brother and I have been making local long distance calls (in Bell's area) using this, off and on phor about 6 years. It's only recently that I've been calling LD using AT&T and other carriers more phrequently.

9. Alter your excuses phor the call not going through, that way you sound like another person each time you call and you don't set up a pattern.
Ie: Phirst time, "didn't make ringing sound.".
    Secound time, "My phax didn't connect.".
    Third time," I got some wierd error notice.".
    Phourth time, etc,etc,etc

10. Use your common phreak-sense.

If you have any questions phind someone who knows me or leave me mail on board that I phrequent.

Quixand 

p.s. If you are on a board I'm on and you've heard of this technique let me know.
                                         