Instead, the authors have extended a proposed backdoor attack from the 1990s to 1024 bit parameters. Specifically, they show that it is now practical to generate a set of SNFS parameters that will produce a random-looking prime with L=1024 N=160 (ie, a plausible DSA parameter). Since the prime is generated to conform to SNFS, it's much easier to solve discrete logs in than a general prime; the difficulty of attacking systems built on it is reduced from state-level to university-level.
It was possible in the '90s to generate these weakened parameters, but not to hide them effectively --- making them useless as NOBUS parameters. Two things appear to have made this tricky: first, the primes in common use at the time were 512/160, and the smaller gap between L/p and N/q gave less flexibility to backdoor designers; secondly, we have much better compute available today. Also, we (meaning them, not me) understand NFS a lot better than we used to.
This paper is interesting from a scientific standpoint and from the standpoint of Kremlinology ("could NSA have done this to earlier systems? was this ever in their repertoire?"). It's not as interesting from a practical perspective today, because:
* 1024 bit FFDH is already presumed broken, and while the compute resources needed to attack SNFS-weakened 1024 bit FFDH might not be state-level, the logistical resources needed to get an SNFS-weakened 1024 bit prime deployed probably still are.
* The most common 1024 bit FFDH parameters we use are if not entirely verifiable than at least significantly more constrained than the parameters this paper generates (for instance, if not derived from the bits of pi, as some are, than at least sequential series of primes).
Most importantly: we've moved away as a field not only from FFDH itself, but also from asymmetric systems with opaque parameters. The Curve25519 parameters, for instance, have clear, easily understood performance and security rationales.