It looks like certainly the result of your DVR being hacked. Seeing 127.0.0.1/localhost in the log indicates that it probably wasn't even a simple authentication bypass, but rather they got enough control over the DVR (e.g. via an SSH connection or some other kind of command injection that...