What strikes me is how the 2008 and 2012 back-doors were so much more advanced than the back-door introduced in 2014. I think that they were placed by differen

What strikes me is how the 2008 and 2012 back-doors were so much more advanced than the back-door introduced in 2014. I think that they were placed by different actors(assuming 2008 and 2012 are from the same), when the more blatant ssh back-door was found Juniper instigated a internal code review and found the more tricky DualEC weakness. If the inclusion of DualEC itself is not enough to convince you that the code changes in 2008 are in fact back-doors then you should consider the fact that the X9.31-AES that they fed the DualEC output into was modified in such a way that it did not actually perform any cryptographic operations at all. x9.31-AES is now considered to be almost depreciated, with the original variant (x9.32-DES2) being officially depreciated since last year. However the fact remains that an adversary implemented and tweaked 2 different cryptographic circuits in the code. Which, imo, is no mean feat. In comparison, a simple strmp() smack in the middle of the authentication code is a simple trick. But, obviously, in the absolute sense still nothing to sniff at.