Seems that there is some malware on the loose, called Linux.MulDrop.14, that infects linux based systems with a default user called pi presumably on Rasmbmc OS.
This malware then changes the password to “\$6\$U1Nu9qCp\$FhPuo8s5PsQlH6lwUdTwFcAUPNzmr0pWCdNJj.p6l4Mzi8S867YLmc7BspmEH95POvxPQ3PzP029yT1L3yi6K1” searches for other RPi’s on your network and also starts to mine bitcoin.
I suspect it wouldn’t be out of the question for the malware to be modded to check for and thus infect other distributions like LibreElec, OpenElec, OSMC, etc.
Guess this just goes to show how bad it is for a distribution to not allow the user to change default user and password during an install process.
This behaviour is up there with the poor security focus often seen by those developing POE security cameras that are oh so hackable 
Here is another link discussing Linux.MulDrop.14 which also links to SMB vulnerability discussion…
Does Team Kodi have any opinions on such maters and do you guys have any sway in pushing for better security standards within distributions like LibreELec, OpenElec, Zbian, Raspbmc, OSMC, etc that contain Kodi?
Is it worth having a security forum?