What is required for a backdoor
By definition, a backdoor is created by someone with access to the system or code in question in order to facilitate future access.
A backdoor is software functionality built or installed by someone intentionally. In contrast, a typical vulnerability has no purpose. A typical vulnerability is the result of an accident or oversight by a developer, integrator, or administrator.
How to identify one
There is no definitive standard for identifying a backdoor. This is usually judged by considering the method by which it operates as well as whether it appears to be designed rather than accidental.
The overriding concern is whether the party who created it would also be the one to use it (or, perhaps, to sell access to it).
E.g., if a login utility always accepts a specific undocumented username/password, then it is likely a backdoor. It is quite reasonable to assume that a developer coded that functionality specifically to allow him access.
On the other hand, it could be a simple truncation bug or "performance" tweak if a login utility is built so that it only uses the first 8 characters of a password to generate a hash. Obviously, this makes the system vulnerable to brute forcing or rainbow table attacks, but there is no clear basis to presume that the developer would exploit it.