Lets say John lives near (200 miles away) the C&C server and that John's IP is 192.168.7.2. John is the decoy, so the malware sends requests to John's IP. John doesn't get the requests, due to his firewall blocking them, leaving these lingering open tcp connections. So the C&C server is free to finish the TCP handshake spoofing their IP to be 192.168.7.2
As far as anyone can tell they are John, but when you go to John's house to shut down the C&C server you end up at a dead end.
2) How does the C&C server complete the request. Are the hanging ports on the victim's side?
3) If the C&C server completes the connection, how do they carry on talking? Just like spoofing IPs, you can't ever get a reply. Or do they do the John decoy thing for every packet?
1) The satellite system system broadcasts to everyone (apparently poorly/not encrypted) in the area, so it isn't necessary to take over any upstream routing in order to get a hold of the incoming packets. They just arrive at your doorstep, and since you configured them to be rejected by normal clients you know you won't have to compete for the response.
2) The C&C just responds over regular land-line. (Since the satellite service is download-only, this isn't any different from the service's normal clients.)
3) The reply keeps coming back over satellite and they keep grabbing it?
I believe you are correct in your understanding. Mine was a little different. I thought this was a classic asymmetrical routing scenario on the Internet with a cool eavesdropper twist.
I'm assuming that because the sat system broadcasts unencrypted, you can sniff all the packets for all hosts on that network just like you can on a wifi network with the proper promiscuous mode receiver. An unencrypted shared broadcast medium.
So packet flow is routed inbound from victim as such
(victim SYN to decoy IP) to (internet) to (sat broadcast to geographic area decoy and attacker C&C)
But packet flow outbound from C&C to victim is handled differently via landline
(spoofed decoy IP) to (landline/internet) to (victim)
So packets come in via sat link but go out via spoofed source on a landline.
As far as anyone can tell they are John, but when you go to John's house to shut down the C&C server you end up at a dead end.