Charming. Just charming. NOT!
It's not the camera or DVR - it's components in them manufactured by XiongMai. And so far, nobody has said WHICH brands use these components. The passwords are hard-coded and therefore not something you can do anything about - other than disconnecting the device from the internet. However, there is little point in doing that until we know more.
From Fortune:
QUOTE
The software used to control these devices—which almost certainly number into the millions—is a malware package known as Mirai (the Japanese word for “future”). The source code for that software was made public by its anonymous creator earlier this month, meaning that any of a huge number of malicious hackers could have been responsible for yesterday’s attack.