Good find. Wow, that repo is a class act. Binaries checked in and everything. Clearly looks like this and the OP's DVR share lineage.

From what I can tell, the e-mail address etc. are defaults used in CGI_send_email, which is only invoked as the handler for the /email endpoint. Looking at the order of endpoints defined in https://github.com/simonjiuan/ipc/blob/master/src/ipcam_netw... it seems that /email was probably left out in the DVR's code, so it's possible this function is simply never invoked, and we're just left with the WTF that not only did the original author (Mr. Law) think that an e-mail service needed a default "To", but that he thought it should be him, and that he left it in the final product.

Yeah, it wasn't at all clear to me from 2 minutes of static analysis under what circumstances an email would be sent and to which address. I'd hope the authors of the linked article would have verified this with a packet sniffer (as mentioned in another comment here) before making the claim.

Sorry, should have been more clear.

Yes, it does send the emails.

I surely hope that somebody can figure out how to make firmware images for these, and use this code as a base to fix these flaws. A kind DD-DVR project, if you would.

Good find.

And according to that source, you can change that target email address via a request parameter.

Just got deleted. Anyone has mirror?

Yes. http://archive.is/HUW8c

Thanks, I found another repo here: https://github.com/zackxue/ipc