It's possible for Tor exit nodes to sniff traffic on normal websites, unless you connect via SSL/HTTPS. But what about hidden services, they don't seem to support the HTTPS protocol.
Can the exit node sniff/modify the traffic?
Tor exit nodes aren't involved in the connection to hidden services. Exit nodes are only needed when you want to exit the Tor network in order to connect to some website outside of it. In the case of connecting to hidden services, all the traffic stays inside the Tor network.
In the following illustration, you can see how Bob (a normal user) is trying to connect to Alice (hosting a hidden service). As you can see, the connection happens through a Rendezvous point (RP) inside the Tor network.
All traffic inside the Tor network are encrypted and secured with TLS tunnels.
Yes, it is.
A TOR hidden service deposits its public key in the distributed hash table of the TOR network and on several random nodes ("introductory points") all over the TOR network. When a client wants to connect to a hidden service, the first thing it does is to get that public key so it can encrypt the request to the hidden service.
That means hidden services don't need HTTPS, because the TOR hidden service protocol already provides end-to-end encryption. The public key infrastructure of the TOR network is even more secure than HTTPS, because it doesn't rely on public certificate authorities which can be compromised.
In fact, getting a certificate from a CA would make it quite pointless to have a hidden service in the first place. The purpose of a TLS certificate signed by a CA is to prove your identity. The purpose of a hidden service is to conceal your identity. When you don't want anonymity for yourself and only for your users, then set up a webserver on a non-onion domain, get a TLS certificate, and only allow connections from TOR exit nodes. That would also have a much better performance, by the way.
Yes. By consequence, there is no need for TLS , STARTLS, SSL when connecting to an *****.onion mailserver (like the bitmessage gateway and onionmail). However, onionmail for some odd reason still uses STARTLS. Also, Thunderbird with Torbirdy displays such a mailserver connection as "insecure and dangerous" because Thunderbird is unaware of .onion business and misinforms the user.
This adds to the confusion resulting in the OP's question.