Someone posted this on reddit a few days ago, and I haven't found much about it except for links back to the same page. Here's the article
And for a brief summary, essentially, it's possible to introduce a backdoor during RSA key generation. For example, to generate a backdoored RSA-1024 key. (Assuming getPrime(x) will return a random X-bit prime number)
$$A = genPrime(384)$$
$$P^\prime = genPrime(128)$$
$$Q^\prime = genPrime(128)$$
$$P = A*k_1 + P^\prime$$
Where $k_1$ is incremented until $P$ is prime, starting with $k_1 = P^\prime$.
$$Q = A*k_2 + Q^\prime$$
$k_2$ is is calculated similarly for $Q^\prime$.
$P$ and $Q$ are then used as the prime numbers for the rest of the key generation algorithm, and $A$ is kept as the backdoor key. $A$ can be generated based off of a predictable per-user value, like a MAC address or user ID.
To use the backdoor, the attacker (or in this case, developer) recalculates $A$ in the same way it was originally calculated (or just looks it up in a database) and then calculates $N^\prime = N \mod A$ and then factors $N^\prime$ into $P^\prime * Q^\prime$. This will take the complexity of factoring a 256-bit number, which is well within reach of most organisations concerned with implementing backdoors. $P^\prime$ and $Q^\prime$ can then be used to calculate $P$ and $Q$ in the same way as above, and thus generate the entire private key.
Is there any more information about this? Possible attacks? (besides the obvious one in the case that $A$ is leaked) It seems intuitive that this would lower the security of RSA, considering it's lowering the key space from 1024-bit to 256-bit, but I don't see how it can be broken without knowing $A$.