How the Dual_EC_DRBG elliptic-curve backdoor worked

HN points to it as an intuitive explanation of how NIST standardized a backdoored generator.

Dr Mike Pound explains the suspected backdoor in the Dual_EC_DRBG random number generator and how elliptic curve constants could let someone predict its output.