Domain squatting is, to the best of my knowledge, legal; but there are a variety of mechanisms by which people who have some sort of "legitimate" claim to a given domain can force transfer for something along the lines of "fair market value". So if you are a celebrity, or a corporation, or holder of trademark, and somebody has the domain that is closely associated with you, or your brand, or whatever, you can probably get the court to force them out. If not, it's pretty much first come, first serve.