If you can find the password on a public forum in five seconds, so can a bot. So can a hacker. So can a former employee. The moment a DVR is connected to the internet without changing that default, it ceases to be a security device and becomes a public webcam. It becomes part of the "Internet of Things" botnets that fuel massive DDoS attacks.
