The attack works by changing DNS settings on the victims computer through malware or a malicious Web site and then redirects the victim to sites of the attacker's choice.

"It's really the ultimate back door," said Chris Rouland, chief technology officer with IBM's Internet Security Systems division. "All the stuff we've deployed in the enterprise, it's not going to look for this."

And that is the biggest problem - we're not looking for this. How often do you check your DNS settings? I use OpenDNS and it displays an OpenDNS page when I mistype a URL but that page is easily spoofed. I depend on anti-malware on the desktop, the more secure operating systems, and I'm try to be careful with questionable Web sites and use McAfee Site Advisor. (McAfee is sponsor of this site). Ars Technica argues for something similar but notes it is not a fool proof solution:

Vista's UAC would actually defend a system from this type of attack by notifying the user that a program was attempting to change the system's DNS settings. I'm not sure if current malware software from various vendors would detect and prevent DNS-level hijacking, but again, such protection and notification could be implemented on a software level. The availability of user-level protection is by no means a complete solution to the problem; software companies cannot assume that all users avail themselves of the appropriate level of malware software or install the appropriate patches, but it is a place to start.